GitHub Security Advisory: GHSA-h27v-ph7w-m9fp
Package: github.com/0xJacky/Nginx-UI (GO)
Severity: HIGH (CVSS 8.1)
CWE: CWE-306: Missing Authentication for Critical Function
Vulnerable versions: >= 2.0.0, <= 2.3.5
Patched in: 2.3.8

Summary: Nginx-UI: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim

Details:
### Summary
An unauthenticated network attacker can claim the initial administrator account on a fresh `nginx-ui` instance during the first-run setup window. The public `/api/install` endpoint is reachable without authentication, and the request-encryption flow only protects payload confidentiality in transit; it does not authenticate who is allowed to perform installation. A remote attacker who reaches the service before the legitimate operator can set the admin email, username, and password, causing permanent initial-instance takeover.

### Details
The vulnerable route is exposed publicly through the main API router. `router/routers.go:61-70` mounts `system.InitPublicRouter(root)` under `/api`, and `api/system/router.go:16-19` registers both `GET /api/install` and `POST /api/install` without `AuthRequired()`.

The install handler only checks whether the instance is already installed and whether more than ten minutes have elapsed since startup. `api/system/install.go:26-33` treats the instance as uninstalled when `JwtSecret` is empty and `SkipInstallation` is false. `api/system/install.go:56-69` rejects requests only if installation has already happened or the ten-minute window has expired.

If those checks pass, the unauthenticated caller controls the initialization flow. `api/system/install.go:77-81` generates and saves the JWT secret, node secret, and certificate email from attacker-controlled input, and `api/system/install.go:93-97` overwrites user ID `1` with the attacker-chosen username and password hash. `internal/kernel/init_user.go:15-22` guarantees that privileged user ID `1` exists ahead of time, so there is always an account to claim.

The public-key bootstrap does not add authentication. `api/crypto/router.go:5-9` exposes `POST /api/crypto/public_key` publicly, `api/crypto/crypto.go:12-32` returns a server public key to any caller, `internal/crypto/crypto.go:44-61` stores a shared keypair in cache, and `internal/middleware/encrypted_params.go:25-50` only decrypts `encrypted_params` before passing the request to the install handler. No request ID, local-only restriction, bootstrap secret, or prior trust check is enforced.

This was verified locally in an isolated lab instance. A fresh instance returned `{"lock":false,"timeout":false}`, an unauthenticated `POST /api/install` returned `{"message":"ok"}`, the instance then flipped to `{"lock":true,"timeout":false}`, and the on-disk SQLite database showed user ID `1` renamed to the attacker-controlled username with a non-empty password hash.

### PoC
The quickest local verification path is the helper script created during validation:

```bash
ATTACKER_EMAIL='attacker@example.com' ATTACKER_USER='attacker' ATTACKER_PASS='Password12345' \
'/Users/r1zzg0d/Documents/CVE hunting/targets/nginx-ui/output/verify/verify_fresh_install_takeover.sh'
```

Expected proof points:

```text
[1/6] Fresh-instance status:
{
  "lock": false,
  "timeout": false
}

[3/6] Claiming the initial administrator accou