UpHeron
All vulnerabilities

Servers and applications

CVE-2024-23828

Authenticated RCE through injecting into the application config via CRLF

Severity
High 8.8
Published
28 Jan 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.0.0-beta.11, 2.0.0
Also known as
GHSA-qcjq-7f7v-pvc8
Sources
NVD, Project advisories (GitHub)

Description

Nginx-UI is a web interface to manage Nginx configurations. It is vulnerable to an authenticated arbitrary command execution via CRLF attack when changing the value of test_config_cmd or start_cmd. This vulnerability exists due to an incomplete fix for CVE-2024-22197 and CVE-2024-22198. This vulnerability has been patched in version 2.0.0.beta.12.

Affected software

SoftwareAffected versions
Nginx UIServers and applications · cpe:a:nginxui:nginx_ui
  • Version 2.0.0-beta11
  • Version 2.0.0-beta10_patch
  • Version 2.0.0-beta10
  • Version 2.0.0-beta9
All 18 release lines
  • Every version before 2.0.0
  • Version 2.0.0-beta1
  • Version 2.0.0-beta2
  • Version 2.0.0-beta3
  • Version 2.0.0-beta4
  • Version 2.0.0-beta4_patch
  • Version 2.0.0-beta5
  • Version 2.0.0-beta5_patch
  • Version 2.0.0-beta6
  • Version 2.0.0-beta6_patch
  • Version 2.0.0-beta6_patch2
  • Version 2.0.0-beta7
  • Version 2.0.0-beta8
  • Version 2.0.0-beta8_patch
  • Version 2.0.0-beta9
  • Version 2.0.0-beta10
  • Version 2.0.0-beta10_patch
  • Version 2.0.0-beta11
Nginx UIServers and applications · github:0xjacky/nginx-ui
  • Every version before 2.0.0-beta.11

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-23828
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-23828
  • GitHub Advisory Database https://github.com/advisories/GHSA-qcjq-7f7v-pvc8
  • github.com https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-qcjq-7f7v-pvc8