Executive Summary

This vulnerability affects the Nginx UI, a web user interface for the Nginx web server, in versions prior to 2.3.4. When an administrator disables a user, the previously issued API tokens for that user remain valid until their token lifetime expires. This means that even after disabling a compromised account, the attacker who stole the JWT (JSON Web Token) can continue to access and modify protected resources. Additionally, since these tokens can be used to create new accounts, the disabled user can maintain privileges despite being disabled.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows an attacker who has stolen a JWT from a disabled user to continue accessing and modifying protected resources without interruption. This can lead to unauthorized data access, data modification, and potentially the creation of new accounts with elevated privileges, undermining the security controls intended to restrict access.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Nginx UI to version 2.3.4 or later, where the issue is patched.

Since disabling a user does not revoke previously issued API tokens, it is important to invalidate or revoke all existing tokens associated with disabled accounts to prevent continued access.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows a disabled user to continue accessing and modifying protected resources using previously issued API tokens, which means that access control measures are effectively bypassed.

Such unauthorized continued access could lead to violations of compliance requirements in standards and regulations like GDPR and HIPAA, which mandate strict control over user access and protection of sensitive data.

Specifically, failure to revoke access promptly after disabling a user may result in unauthorized data exposure or modification, undermining data protection and privacy obligations.

Useful 0 Not Useful 0