Kurz gesagt
- CVE-2024-23828 ist eine Schwachstelle (HOCH (CVSS 8.8)) in github.com/0xJacky/Nginx-UI, nginx ui (nginxui).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.1%, höher als bei 64.4% aller Schwachstellen.
- Abhilfe: auf 1.9.10-0.20240126104956-d70e37c8575e, 2.0.0 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| github.com/0xJacky/Nginx-UI Go | < 1.9.10-0.20240126104956-d70e37c8575eall versions
| 1.9.10-0.20240126104956-d70e37c8575e
|
| nginx ui | = 2.0.0< 2.0.0
| 2.0.0
|
Description
Summary
Fix bypass to the following bugs
Allowing to inject directly in the app.ini via CRLF to change the value of test_config_cmd and start_cmd resulting in an Authenticated RCE
Impact
Authenticated Remote execution on the host
NVD description
Nginx-UI is a web interface to manage Nginx configurations. It is vulnerable to an authenticated arbitrary command execution via CRLF attack when changing the value of test_config_cmd or start_cmd. This vulnerability exists due to an incomplete fix for CVE-2024-22197 and CVE-2024-22198. This vulnerability has been patched in version 2.0.0.beta.12.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free