PT-2024-6493 · Unknown · Nginx Proxy Manager

Jc21 · Published 2024-07-01 · Updated 2025-10-30 · CVE-2024-46256

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NginxProxyManager version 2.11.3

Description A command injection issue exists in the requestLetsEncryptSsl function of NginxProxyManager. This allows a remote attacker to execute arbitrary commands by adding a specially crafted Let's Encrypt certificate. The issue is related to insufficient data sanitization on the management level. Exploitation can lead to Remote Code Execution (RCE).

Recommendations NginxProxyManager version 2.11.3: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2024-07585

BDU:2024-07698

CVE-2024-46256

Affected Products

Nginx Proxy Manager

References · 19

• 🔥 https://github.com/barttran2k/POC_CVE-2024-46256 · Exploit
• https://github.com/NginxProxyManager/nginx-proxy-manager/pull/4073/commits/c39d5433bcd13993def222bbb2b6988bbb810a05 · Patch
• https://bdu.fstec.ru/vul/2024-07698 · Security Note
• https://bdu.fstec.ru/vul/2024-07585 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-46257 · Security Note
• https://osv.dev/vulnerability/CVE-2024-46256 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-46256 · Security Note
• https://github.com/NginxProxyManager/nginx-proxy-manager/blob/v2.11.3/backend/internal/certificate.js#L830 · Note
• https://github.com/NginxProxyManager/nginx-proxy-manager/commit/99cce7e2b0da2978411cedd7cac5fffbe15bc466 · Note
• https://github.com/NginxProxyManager/nginx-proxy-manager · Note
• https://t.me/cvenotify/96955 · Telegram Post
• https://vulners.com/nvd/NVD:CVE-2024-46257 · Note
• https://t.me/cvenotify/124453 · Telegram Post
• https://twitter.com/HackingTeam777/status/1983770979819253837 · Twitter Post
• https://t.me/cvedetector/6570 · Telegram Post