Description
NGINX Plus is a software load balancer, web server, and content cache built on top of open source NGINX. NGINX Plus has exclusive enterprise grade features beyond what's available in the open source offering, including session persistence, configuration via API, and active health checks.
NGINX+ contains a ngx_http_api_module module. The ngx_http_api_module module (1.13.3) provides REST API for accessing various status information, configuring upstream server groups on-the-fly, and managing key-value pairs without the need of reconfiguring nginx.
Acunetix determined that it was possible to access this REST interface without authentication. The write parameter from the NGINX+ configuration determines whether the API is read-only or read-write. The API is currently configured as read-write.
It's recommended to restrict access to the NGINX+ API interface.
Remediation
Restrict access to the NGINX+ API interface.