Nginx UI Logrotate Configuration Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in Nginx UI versions prior to 2.3.4. The issue arises from improper input validation in the logrotate configuration, allowing authenticated users to cause the web interface to become unresponsive. By submitting a negative integer for the rotation interval, the backend can enter an infinite loop or an invalid state, leading to a complete service hang. This vulnerability has been patched in version 2.3.4.

Impact

Exploitation of this vulnerability causes a complete denial-of-service condition, where the web interface becomes unresponsive and the server fails to handle concurrent requests.

Reproduction

To reproduce this vulnerability, authenticate to the Nginx UI dashboard and send a POST request to the /api/settings endpoint. Include a negative integer in the logrotate.interval field. After the request is processed, the web server will stop responding to all subsequent requests.

Remediation

Users are advised to update Nginx UI to version 2.3.4 or later.