The vulnerability in nginx-ui versions before 2.3.5 involves missing origin validation on WebSocket connections. The gorilla/websocket Upgrader's CheckOrigin function unconditionally returns true, permitting any origin to establish WebSocket connections. Because authentication tokens are stored in cookies accessible via JavaScript and lack protective attributes, an attacker-controlled webpage can hijack WebSocket sessions of logged-in administrators via Cross-Site WebSocket Hijacking. This can lead to unauthorized actions through the WebSocket interface. The issue is fixed in version 2.3.5.

An attacker can exploit this vulnerability to perform Cross-Site WebSocket Hijacking, potentially allowing unauthorized WebSocket interactions with the nginx-ui instance under the context of an authenticated administrator. This could lead to unauthorized commands or data access through the WebSocket interface. The CVSS 4.0 score is 5.5 (medium severity), reflecting network attack vector, no privileges required, user interaction needed, and high impact on integrity and availability.

Upgrade nginx-ui to version 2.3.5 or later, where the origin validation for WebSocket connections has been properly implemented. Until upgraded, users should be cautious about visiting untrusted webpages while logged into nginx-ui, as the vulnerability requires user interaction. No official patch links or vendor advisory were provided; therefore, verify the upgrade availability from the vendor or trusted sources.