CVE-2024-23827
Critical
Description
Nginx-UI is a web interface to manage Nginx configurations. The Import Certificate feature allows arbitrary write into the system. The feature does not check if the provided user input is a certification/key and allows to write into arbitrary paths in the system. It's possible to leverage the vulnerability into a remote code execution overwriting the config file app.ini. Version 2.0.0.beta.12 fixed the issue.
SeverityCritical
CVSS9.8
Exploit probability—
ProductNginxui Nginx Ui
PublishedJan 29, 2024
First seenJan 29, 2024
Weakness typeCWE-22Path traversal
How to fix
Update
- github.com/0xJacky/Nginx-UI1.9.10-0.20240128060047-8581bdd3c6f4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nginxui nginx_ui | 1.2.0, 1.2.1, 1.2.2, 1.3.0, 1.3.1, 1.3.2, 1.3.3, 1.4.0, 1.4.1, 1.4.2, 1.5.0, 1.5.1, 1.5.2, 1.6.0, 1.6.1, 1.6.2, 1.6.3, 1.6.5, 1.6.6, 1.6.7, 1.6.8, 1.7.0, 1.7.1, 1.7.2, 1.7.3, 1.7.4, 1.7.5, 1.7.6, 1.7.7, 1.7.8, 1.7.9, 1.8.0, 1.8.1, 1.8.2, 1.8.3, 1.8.4, 1.9.9, 1.9.9-1, 1.9.9-2, 1.9.9-3, 1.9.9-4, 2.0.0 | — |
| github.com/0xJacky/Nginx-UIGo | v < 1.9.10-0.20240128060047-8581bdd3c6f4, No range specified | 1.9.10-0.20240128060047-8581bdd3c6f4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.