Unauthenticated Remote Takeover of Nginx-UI via MCP Endpoint

The nginx-ui MCP (Model Context Protocol) integration exposes two HTTP endpoints: /mcp and /mcp_message. While /mcp requires authentication, the /mcp_message endpoint only applies IP whitelisting - and the default IP whitelist is empty, which the middleware treats as "allow all". This vulnerability, affecting nginx-ui versions 1.99 and earlier, allows any network attacker to invoke all MCP tools without authentication via the /mcp_message endpoint. This includes restarting nginx, creating/modifying/deleting nginx configuration files, and triggering automatic config reloads. Successful exploitation leads to complete nginx service takeover. This is critical for defenders as it provides an unauthenticated pathway to control a critical piece of infrastructure typically fronting web applications.

Attack Chain

1. Attacker sends an HTTP POST request to http://target:9000/mcp_message with a JSON payload.
2. The request bypasses authentication checks due to the missing AuthRequired() middleware on the /mcp_message endpoint.
3. The IPWhiteList() middleware allows all requests because the default IP whitelist is empty.
4. The request is routed to the mcp.ServeHTTP() handler.
5. The attacker invokes the nginx_config_add MCP tool to create a malicious nginx configuration file, for example in /etc/nginx/conf.d/.
6. The nginx_config_add tool writes the malicious configuration file to disk.
7. After the config is written, nginx_config_add attempts to reload nginx configuration via nginx.Control(nginx.Reload).
8. The attacker now controls the Nginx webserver and can intercept traffic, redirect users, and exfiltrate data.

Impact

Successful exploitation of this vulnerability grants an unauthenticated attacker complete control over the nginx service. This allows the attacker to intercept traffic, rewrite server blocks, capture credentials and session tokens, and disrupt service by writing invalid configurations. All existing nginx configurations are readable via nginx_config_get, potentially revealing backend topology and authentication headers. This poses a significant risk to organizations relying on nginx-ui to manage their web servers.

Recommendation

• Apply the patch suggested in the advisory by adding middleware.AuthRequired() to the /mcp_message route to prevent unauthenticated access (reference: GitHub advisory).
• Deploy the Sigma rule "Detect Nginx-UI MCP Message Endpoint Usage" to identify potential exploit attempts in your environment (reference: Sigma rule below).
• Monitor network connections to port 9000 (default nginx-ui port) for suspicious POST requests to /mcp_message (reference: IOC).
• Consider changing the default IP whitelist behavior to deny-all when unconfigured (reference: GitHub advisory).