PT-2024-4599 · Nginx · Nginx Proxy Manager
Igor Duino
·
Published
2024-03-28
·
Updated
2025-10-02
·
CVE-2024-39935
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
NGINX Proxy Manager versions prior to 2.11.3
Description:
The issue allows an authenticated user with certificate management privileges to inject OS commands through untrusted input in the DNS provider configuration, potentially enabling remote attackers to execute arbitrary commands by modifying the DNS provider configuration. The vulnerability exists due to the lack of measures to neutralize special elements used in the OS command.
Recommendations:
For NGINX Proxy Manager versions prior to 2.11.3, update to version 2.11.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the
backend/internal/certificate.js script and limiting the ability to modify the DNS provider configuration to minimize the risk of exploitation. Avoid using untrusted input in the DNS provider configuration until the issue is resolved.Fix
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Nginx Proxy Manager