CVE-2024-23827: Nginx-UI vulnerable to arbitrary file write through the Import Certificate feature

func AddCert(c *gin.Context) {
var json struct {
Name                  string `json:"name"`
SSLCertificatePath    string `json:"ssl_certificate_path" binding:"required"`
SSLCertificateKeyPath string `json:"ssl_certificate_key_path" binding:"required"`
SSLCertificate        string `json:"ssl_certificate"`
SSLCertificateKey     string `json:"ssl_certificate_key"`
ChallengeMethod       string `json:"challenge_method"`
DnsCredentialID       int    `json:"dns_credential_id"`
}
if !api.BindAndValid(c, &json) {
return
}
certModel := &model.Cert{
Name:                  json.Name,
SSLCertificatePath:    json.SSLCertificatePath,
SSLCertificateKeyPath: json.SSLCertificateKeyPath,
ChallengeMethod:       json.ChallengeMethod,
DnsCredentialID:       json.DnsCredentialID,
}

err := certModel.Insert()

if err != nil {
api.ErrHandler(c, err)
return
}

content := &cert.Content{
SSLCertificatePath:    json.SSLCertificatePath,
SSLCertificateKeyPath: json.SSLCertificateKeyPath,
SSLCertificate:        json.SSLCertificate,
SSLCertificateKey:     json.SSLCertificateKey,
}

err = content.WriteFile()

if err != nil {
api.ErrHandler(c, err)
return
}

c.JSON(http.StatusOK, Transformer(certModel))
}

func (c *Content) WriteFile() (err error) {
// MkdirAll creates a directory named path, along with any necessary parents,
// and returns nil, or else returns an error.
// The permission bits perm (before umask) are used for all directories that MkdirAll creates.
// If path is already a directory, MkdirAll does nothing and returns nil.

err = os.MkdirAll(filepath.Dir(c.SSLCertificatePath), 0644)
if err != nil {
return
}

err = os.MkdirAll(filepath.Dir(c.SSLCertificateKeyPath), 0644)
if err != nil {
return
}

if c.SSLCertificate != "" {
err = os.WriteFile(c.SSLCertificatePath, []byte(c.SSLCertificate), 0644)
if err != nil {
return
}
}

if c.SSLCertificateKey != "" {
err = os.WriteFile(c.SSLCertificateKeyPath, []byte(c.SSLCertificateKey), 0644)
if err != nil {
return
}
}

return
}