要点
- CVE-2024-23828 是影响 github.com/0xJacky/Nginx-UI, nginx ui (nginxui) 的高危 (CVSS 8.8)漏洞。
- 未来 30 天内被利用的概率（EPSS）：1.1%，高于 64.4% 的漏洞。
- 修复：升级到 1.9.10-0.20240126104956-d70e37c8575e, 2.0.0 或更高版本。
| Package | Affected versions | Patched versions |
|---|
| github.com/0xJacky/Nginx-UI Go | < 1.9.10-0.20240126104956-d70e37c8575eall versions
| 1.9.10-0.20240126104956-d70e37c8575e
|
| nginx ui | = 2.0.0< 2.0.0
| 2.0.0
|
Description
Summary
Fix bypass to the following bugs
Allowing to inject directly in the app.ini via CRLF to change the value of test_config_cmd and start_cmd resulting in an Authenticated RCE
Impact
Authenticated Remote execution on the host
NVD description
Nginx-UI is a web interface to manage Nginx configurations. It is vulnerable to an authenticated arbitrary command execution via CRLF attack when changing the value of test_config_cmd or start_cmd. This vulnerability exists due to an incomplete fix for CVE-2024-22197 and CVE-2024-22198. This vulnerability has been patched in version 2.0.0.beta.12.
github.com/0xJacky/Nginx-UI 的其他漏洞
查看全部 →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free