NGINX Agent and NGINX Instance Manager Path Traversal Vulnerability Allowing Unauthorized File Access

A vulnerability exists in the NGINX Agent's config_dirs directive, which can be managed through NGINX Instance Manager. This issue allows a low-privileged, remotely authenticated attacker to read and write files outside the designated secure directory, potentially crossing important security boundaries.

Impact

Exploitation of this vulnerability could lead to unauthorized file access and modification, allowing attackers to read or write files outside of the intended directory restrictions.

Remediation

Users can upgrade to NGINX Agent version 2.47.0 or NGINX Instance Manager version 2.22.1 to address this vulnerability.