GHSA-5hf2-vhj6-gj9m nginx-UI has Unencrypted Storage of DNS API Tokens and ACME Private Keys
SummaryNginx-UI contains an Insecure Direct Object Reference (IDOR) vulnerability that allows any authenticated user to access, modify, and delete resources belonging to other users. The application's base `Model` struct lacks a `user_id` field, and all resource endpoints perform queries by ID without verifying user ownership, enabling complete authorization bypass in multi-user environments.Severity**High** - CVSS 3.1 Score: **8.8 (High)**Vector String: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`**Note**: Original score was 7.5. The score was updated to 8.8 after discovering that sensitive data (DNS API tokens, ACME private keys) is stored in plaintext, which when combined with IDOR allows immediate credential theft without decryption.Productnginx-uiAffected VersionsAll versions up to and including v2.3.3CWECWE-639: Authorization Bypass Through User-Controlled KeyDescriptionExposed DNS Provider CredentialsThe `dns.Config` structure (`internal/cert/dns/config_env.go`) contains API credentials:| Provider | Credential Fields | Impact if Leaked |
|----------|------------------|------------------|
| Cloudflare | `CF_API_TOKEN` | Full DNS zone control |
| Alibaba Cloud DNS | `ALICLOUD_ACCESS_KEY`, `ALICLOUD_SECRET_KEY` | Full DNS control + potential IAM access |
| Tencent Cloud DNS | `TENCENTCLOUD_SECRET_ID`, `TENCENTCLOUD_SECRET_KEY` | Full DNS control |
| AWS Route53 | `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY` | Route53 + potential AWS access |
| GoDaddy | `GODADDY_API_KEY`, `GODADDY_API_SECRET` | DNS record modification |Combined Attack: IDOR + Plaintext StorageWhen the IDOR vulnerability is combined with plaintext storage, attackers can directly extract API tokens from other users' resources:PoC: Extracting Plaintext Credentials via IDORUpdated CVSS Score with Plaintext StorageThe plaintext storage increases the confidentiality impact:**CVSS 3.1 Score: 8.8 (High)**Vector: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`**Scope Changed (S:C)**: Impact extends to external services (DNS providers, cloud platforms)**High Confidentiality (C:H)**: Plaintext API tokens immediately usable**High Integrity (I:H)**: DNS records, certificates can be modified**High Availability (A:H)**: Services can be disrupted via DNS/certificate manipulationAttack Scenario: Certificate HijackingCreditDiscovered by security researcher during authorized security audit.RecommendationImmediate Mitigation**Add User Ownership to Models****Filter Queries by Current User****Add Authorization Middleware**Database MigrationLong-term ImprovementsImplement role-based access control (RBAC)Add audit logging for resource accessImplement resource sharing functionality with explicit permissionsAdd integration tests for authorization checksRemediation for Plaintext StorageImmediate Fix: Encrypt Sensitive FieldsApply the same `serializer:json[aes]` pattern used for S3 credentials to DNS and ACME data:**model/dns_credential.go:****model/acme_user.go:**Data MigrationExisting plaintext data must be re-saved to trigger encryption:Summary of Required Changes| File | Line | Current | Fix |
|------|------|---------|-----|
| `model/dns_credential.go` | 7 | `serializer:json` | `serializer:json[aes]` |
| `model/acme_user.go` | Key field | `serializer:json` | `serializer:json[aes]` |References[CWE-639: Authorization Bypass Through User-Controlled Key](https://cwe.mitre.org/data/definitions/639.html)[OWASP IDOR Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html)[PortSwigger: IDOR Vulnerabilities](https://portswigger.net/web-security/access-control/idor)Disclosure Timeline**2026-03-13**: Vulnerability discovered through source code audit**2026-03-13**: Vulnerability successfully reproduced in local Docker environment**2026-03-13**: All IDOR operations verified: READ, MODIFY, DELETE**2026-03-13**: Security advisory prepared**[Pending]**: Report submitted to nginx-ui maintainers**[Pending]**: CVE ID requested**[Pending]**: Patch developed and tested**[Pending]**: Public disclosure (21-90 days after vendor notification)
CVSS v3.1 score: 8.8