CVE-2026-60062

Executive Summary

CVE-2026-60062 is a path traversal vulnerability in NGINX Agent, affecting the config_dirs directive. This flaw allows a low-privileged, authenticated attacker to gain limited read and write access to files outside the intended secure directory. The config_dirs directive can also be configured through NGINX Instance Manager, expanding the attack surface. With a CVSS score of 6.4 (Medium), the vulnerability enables an attacker to cross a security boundary, potentially accessing sensitive configuration files or modifying agent behavior. No public proof-of-concept (PoC) or patch is currently available, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time. However, the lack of a patch and the potential for lateral movement within NGINX-managed environments make this a significant concern for organizations using NGINX Agent.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but affects the NGINX Agent binary, typically distributed via official NGINX repositories or as a standalone package. Organizations should verify the integrity of their NGINX Agent installations and monitor for any unauthorized modifications.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Base Score: 6.4 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – An attacker needs valid low-privileged credentials.
• User Interaction: None (UI:N) – No user action is needed.
• Scope: Changed (S:C) – The vulnerable component impacts resources beyond its security scope.
• Confidentiality Impact: Low (C:L) – Limited read access to files outside the secure directory.
• Integrity Impact: Low (I:L) – Limited write access to files outside the secure directory.
• Availability Impact: None (A:N) – No denial-of-service impact.

Threat Level: Medium. The vulnerability requires authentication but allows boundary crossing, which could be leveraged for privilege escalation or data exfiltration in multi-tenant environments.

Deep Dive & Mechanics

The NGINX Agent uses a config_dirs directive to restrict file access to a set of secure directories. This directive is intended to prevent unauthorized file operations. However, due to improper input validation or path canonicalization, a low-privileged attacker can craft requests that traverse outside the allowed directories. The vulnerability likely stems from insufficient sanitization of user-supplied paths, allowing directory traversal sequences (e.g., ../) to bypass the restriction.

The config_dirs directive can also be configured via NGINX Instance Manager, a centralized management tool. This means an attacker with access to the Instance Manager could potentially propagate the vulnerable configuration to multiple agents, amplifying the impact.

Attack Flow:

1. An attacker authenticates to the NGINX Agent with low-privileged credentials.
2. The attacker sends a request to read or write a file, using a path like ../../etc/nginx/nginx.conf.
3. The agent fails to properly validate the path, allowing access to files outside the config_dirs list.
4. The attacker gains limited read/write access, potentially exposing sensitive data or modifying agent behavior.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the path validation logic of the NGINX Agent. A patched version would likely include:

• Input Validation: Reject paths containing ../ or other traversal sequences.
• Path Canonicalization: Resolve paths to their absolute form and verify they start with an allowed directory.
• Whitelist Enforcement: Only allow operations on files explicitly listed in config_dirs.

Example Vulnerable Code (Pseudocode):

def read_file(path):
    if any(path.startswith(dir) for dir in config_dirs):
        return open(path).read()
    else:
        return "Access denied"

Example Patched Code (Pseudocode):

import os

def read_file(path):
    abs_path = os.path.realpath(path)
    for dir in config_dirs:
        abs_dir = os.path.realpath(dir)
        if abs_path.startswith(abs_dir):
            return open(abs_path).read()
    return "Access denied"

Exploitation & Lab Setup

Red Team

Objective: Gain limited read/write access to files outside the secure directory.

Prerequisites:

• Low-privileged credentials for NGINX Agent.
• Network access to the agent's API (default port 8080).

Exploitation Steps:

1. Authenticate to the NGINX Agent API.
2. Send a crafted request to read a sensitive file:

   curl -X GET "http://agent-host:8080/api/file?path=../../etc/nginx/nginx.conf" -H "Authorization: Bearer <token>"
   

3. If successful, the agent returns the contents of /etc/nginx/nginx.conf.
4. For write access, use a PUT request:

   curl -X PUT "http://agent-host:8080/api/file?path=../../tmp/evil.conf" -d "malicious config" -H "Authorization: Bearer <token>"
   

Note: No public exploit code is available. The above is a conceptual example.

Blue Team

Detection:

• Monitor for unusual file access patterns in NGINX Agent logs.
• Look for requests containing ../ or other traversal sequences.
• Alert on access to sensitive files (e.g., /etc/shadow, /etc/nginx/nginx.conf).

Mitigation:

• Restrict network access to the NGINX Agent API to trusted hosts only.
• Implement strict input validation at the API gateway.
• Use a Web Application Firewall (WAF) to block path traversal attempts.
• Monitor NGINX Instance Manager for unauthorized configuration changes.

Indicators of Compromise (IOCs)

• File Paths: /etc/nginx/nginx.conf, /etc/shadow, /var/log/nginx/access.log (accessed via traversal)
• Log Entries: NGINX Agent logs showing requests with ../ in the path parameter.
• Network Traffic: HTTP requests to the agent API with suspicious path parameters.
• Process Anomalies: NGINX Agent process accessing files outside its designated directories.

Detection Engineering

YARA Rule

rule CVE_2026_60062_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in NGINX Agent requests"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-60062"
    strings:
        $traversal = /\.\.\//
        $agent_api = /\/api\/file/
    condition:
        $agent_api and $traversal
}

Sigma Rule

title: NGINX Agent Path Traversal Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects path traversal attempts in NGINX Agent API requests
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: nginx_agent
detection:
    selection:
        cs-uri-query|contains: '../'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in some configurations
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-60062 NGINX Agent Path Traversal Attempt"; flow:to_server; content:"/api/file"; http_uri; content:"../"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Access: Limit network access to the NGINX Agent API to only trusted IP addresses.
2. Monitor Logs: Enable detailed logging for the NGINX Agent and monitor for path traversal attempts.
3. Apply Workarounds: If possible, disable the config_dirs directive or restrict it to a minimal set of directories.

Long-Term Fix:

• Await an official patch from NGINX. Once available, update to the patched version immediately.
• Implement a Web Application Firewall (WAF) with rules to block path traversal patterns.
• Conduct a security review of the NGINX Agent configuration and ensure least-privilege principles are applied.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.