Scanner Features

✅ Non-destructive testing - Uses only read-only MCP tools
✅ Comprehensive fingerprinting - Identifies nginx-ui installations
✅ Safe proof-of-concept - No configuration changes made
✅ Batch scanning - Process multiple targets from file
✅ Detailed reporting - JSON output for integration

Installation

Usage

Basic Scan

Batch Scanning

Target File Format

How It Works

The scanner performs a multi-stage detection process:

Stage 1: Fingerprinting

Checks common nginx-ui endpoints to identify the installation:

• /api/info - Version information
• /login - Login page
• /api/auth/login - Authentication endpoint
• /mcp and /mcp_message - MCP endpoints

Stage 2: Authentication Check

Tests the /mcp endpoint to verify it properly requires authentication (baseline)

Stage 3: Vulnerability Exploitation

Attempts non-destructive MCP tool calls via /mcp_message WITHOUT authentication:

1. nginx_status (safest) - Reads nginx process status
2. nginx_config_list - Lists configuration files
3. nginx_config_base_path - Gets config directory path

If any tool succeeds without authentication, the vulnerability is confirmed.

Safe MCP Tools Used

The scanner only invokes read-only MCP tools:

Tools explicitly avoided:

• nginx_config_add - Would create files
• nginx_config_modify - Would alter configs
• restart_nginx / reload_nginx - Service disruption
• nginx_config_enable - Would change active configs

Output Examples

Vulnerable Target

Protected Target

Remediation

If the vulnerability is confirmed:

1. Immediate Fix: Add authentication middleware to /mcp_message:

   root@kitploit:~

   r.Any("/mcp_message", middleware.IPWhiteList(), middleware.AuthRequired(),
       func(c *gin.Context) {
           mcp.ServeHTTP(c)
       })
   

2. Defense in Depth:

   • Configure IP whitelist to deny-all by default
   • Restrict MCP endpoints to localhost only if external access not needed
   • Implement rate limiting on MCP endpoints

3. Upgrade: Update to patched nginx-ui version when available

Responsible Disclosure

This tool is designed for:

• ✅ Bug bounty programs
• ✅ Authorized penetration testing
• ✅ Security research with permission
• ✅ Vulnerability validation before disclosure

Do NOT use this tool on systems you don't own or have explicit permission to test.

Bug Bounty Tips

When reporting this vulnerability:

1. Severity: Critical (CVSS 9.8+)

   • Network accessible
   • No authentication required
   • Complete system compromise
   • Config exfiltration + modification

2. Proof: Include scanner output showing successful unauthenticated MCP tool invocation

3. Impact Chain:

   • Unauthenticated access → Config read → Backend topology revealed
   • Config write → Malicious proxy injection → Credential harvesting
   • Nginx restart → Service disruption → DoS

4. Safe PoC: Use only the read-only tools (nginx_status, nginx_config_list)

Technical Details

MCP Tool Invocation Format

Successful Response

Protected Response

References

• CVE: CVE-2026-33032
• Affected: nginx-ui (versions with MCP integration)
• CVSS: 9.8 (Critical)
• CWE: CWE-306 (Missing Authentication for Critical Function)

License

This tool is provided for educational and authorized security testing purposes only.

Author

Antony Esthak Twinson @ Cyber Tamarin
Security Researcher | Bug Bounty Hunter
Specializing in Web Application Security & Vulnerability Research

Disclaimer: This scanner performs non-destructive testing only. Always obtain proper authorization before testing any systems.