Nginx-UI vulnerable to authenticated RCE through injecting into the application config via CRLF

概要

参考情報

• 0xJacky/nginx-ui security advisory · WEB
• nvd.nist.gov/vuln/detail/CVE-2024-23828 · ADVISORY
• 0xJacky/nginx-ui commit d70e37c · WEB
• 0xJacky/nginx-ui · PACKAGE
• pkg.go.dev/vuln/GO-2024-2480 · WEB

github.com/0xJacky/Nginx-UI のその他の脆弱性

• CVE-2026-84312高 7.1Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GetCasdoorUri uses the configured Casdoor application name as a c…
• CVE-2026-84360高 8.1Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSessi…
• CVE-2026-84321中 5.4Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GenerateShortToken creates standalone short-token records without…
• CVE-2026-84320中 6.3Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.3, Nginx UI validates an automatic backup's storage_path, but AutoBa…
• CVE-2026-84319高 8.3Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx direc…