UpHeron
All vulnerabilities

Servers and applications

CVE-2024-23827

Arbitrary file write through the Import Certificate feature

Severity
Critical 9.8
Published
28 Jan 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.0.0-beta.11
Also known as
GHSA-xvq9-4vpv-227m
Sources
NVD, Project advisories (GitHub)

Description

Nginx-UI is a web interface to manage Nginx configurations. The Import Certificate feature allows arbitrary write into the system. The feature does not check if the provided user input is a certification/key and allows to write into arbitrary paths in the system. It's possible to leverage the vulnerability into a remote code execution overwriting the config file app.ini. Version 2.0.0.beta.12…

Affected software

SoftwareAffected versions
Nginx UIServers and applications · cpe:a:nginxui:nginx_ui
  • Version 2.0.0-beta11
  • Version 2.0.0-beta10_patch
  • Version 2.0.0-beta10
  • Version 2.0.0-beta9
All 80 release lines
  • Version 1.2.0-alpha2
  • Version 1.2.0-alpha3
  • Version 1.2.0-alpha4
  • Version 1.2.0-rc1
  • Version 1.2.0-rc2
  • Version 1.2.0-rc3
  • Version 1.2.0
  • Version 1.2.1
  • Version 1.2.2
  • Version 1.3.0-rc1
  • Version 1.3.0
  • Version 1.3.1
  • Version 1.3.1-fix
  • Version 1.3.2
  • Version 1.3.3-rc1
  • Version 1.4.0-rc1
  • Version 1.4.0
  • Version 1.4.1
  • Version 1.4.2
  • Version 1.5.0-beta1
  • Version 1.5.0-beta2
  • Version 1.5.0-beta3
  • Version 1.5.0-beta4
  • Version 1.5.0-beta4_fix
  • Version 1.5.0-beta5
  • Version 1.5.0-beta6
  • Version 1.5.0-beta7
  • Version 1.5.0-beta8
  • Version 1.5.0-beta9
  • Version 1.5.0
  • Version 1.5.1
  • Version 1.5.2
  • Version 1.6.0
  • Version 1.6.0-fix
  • Version 1.6.1
  • Version 1.6.2
  • Version 1.6.3
  • Version 1.6.5
  • Version 1.6.6
  • Version 1.6.7
  • Version 1.6.8
  • Version 1.7.0
  • Version 1.7.0-patch
  • Version 1.7.1
  • Version 1.7.2
  • Version 1.7.3
  • Version 1.7.4
  • Version 1.7.5
  • Version 1.7.6
  • Version 1.7.7
  • Version 1.7.8
  • Version 1.7.9
  • Version 1.8.0
  • Version 1.8.1
  • Version 1.8.2
  • Version 1.8.3
  • Version 1.8.4
  • Version 1.8.4-patch
  • Version 1.9.9
  • Version 1.9.9-1
  • Version 1.9.9-2
  • Version 1.9.9-3
  • Version 1.9.9-4
  • Version 2.0.0-beta1
  • Version 2.0.0-beta2
  • Version 2.0.0-beta3
  • Version 2.0.0-beta4
  • Version 2.0.0-beta4_patch
  • Version 2.0.0-beta5
  • Version 2.0.0-beta5_patch
  • Version 2.0.0-beta6
  • Version 2.0.0-beta6_patch
  • Version 2.0.0-beta6_patch2
  • Version 2.0.0-beta7
  • Version 2.0.0-beta8
  • Version 2.0.0-beta8_patch
  • Version 2.0.0-beta9
  • Version 2.0.0-beta10
  • Version 2.0.0-beta10_patch
  • Version 2.0.0-beta11
Nginx UIServers and applications · github:0xjacky/nginx-ui
  • Every version before 2.0.0-beta.11

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-23827
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-23827
  • GitHub Advisory Database https://github.com/advisories/GHSA-xvq9-4vpv-227m
  • github.com https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-xvq9-4vpv-227m