CVE-2024-23827

Published: Jan 29, 2024Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Nginx-UI is a web interface to manage Nginx configurations. The Import Certificate feature allows arbitrary write into the system. The feature does not check if the provided user input is a certification/key and allows to write into arbitrary paths in the system. It's possible to leverage the vulnerability into a remote code execution overwriting the config file app.ini. Version 2.0.0.beta.12 fixed the issue.

Affected (80)

Products: Nginxui: Nginx Ui

Nginxui

1 product

Nginx Ui

Configuration A

80 vulnerable

Vulnerable Software	Affected Versions
Nginxui Nginx Ui	Version 1.2.0
Nginxui Nginx Ui	Version 1.2.0 alpha2
Nginxui Nginx Ui	Version 1.2.0 alpha3
Nginxui Nginx Ui	Version 1.2.0 alpha4
Nginxui Nginx Ui	Version 1.2.0 rc1
Nginxui Nginx Ui	Version 1.2.0 rc2
Nginxui Nginx Ui	Version 1.2.0 rc3
Nginxui Nginx Ui	Version 1.2.1
Nginxui Nginx Ui	Version 1.2.2
Nginxui Nginx Ui	Version 1.3.0
Nginxui Nginx Ui	Version 1.3.0 rc1
Nginxui Nginx Ui	Version 1.3.1
Nginxui Nginx Ui	Version 1.3.1 fix
Nginxui Nginx Ui	Version 1.3.2
Nginxui Nginx Ui	Version 1.3.3 rc1
Nginxui Nginx Ui	Version 1.4.0
Nginxui Nginx Ui	Version 1.4.0 rc1
Nginxui Nginx Ui	Version 1.4.1
Nginxui Nginx Ui	Version 1.4.2
Nginxui Nginx Ui	Version 1.5.0
Nginxui Nginx Ui	Version 1.5.0 beta1
Nginxui Nginx Ui	Version 1.5.0 beta2
Nginxui Nginx Ui	Version 1.5.0 beta3
Nginxui Nginx Ui	Version 1.5.0 beta4
Nginxui Nginx Ui	Version 1.5.0 beta4_fix
Nginxui Nginx Ui	Version 1.5.0 beta5
Nginxui Nginx Ui	Version 1.5.0 beta6
Nginxui Nginx Ui	Version 1.5.0 beta7
Nginxui Nginx Ui	Version 1.5.0 beta8
Nginxui Nginx Ui	Version 1.5.0 beta9
Nginxui Nginx Ui	Version 1.5.1
Nginxui Nginx Ui	Version 1.5.2
Nginxui Nginx Ui	Version 1.6.0
Nginxui Nginx Ui	Version 1.6.0 fix
Nginxui Nginx Ui	Version 1.6.1
Nginxui Nginx Ui	Version 1.6.2
Nginxui Nginx Ui	Version 1.6.3
Nginxui Nginx Ui	Version 1.6.5
Nginxui Nginx Ui	Version 1.6.6
Nginxui Nginx Ui	Version 1.6.7
Nginxui Nginx Ui	Version 1.6.8
Nginxui Nginx Ui	Version 1.7.0
Nginxui Nginx Ui	Version 1.7.0 patch
Nginxui Nginx Ui	Version 1.7.1
Nginxui Nginx Ui	Version 1.7.2
Nginxui Nginx Ui	Version 1.7.3
Nginxui Nginx Ui	Version 1.7.4
Nginxui Nginx Ui	Version 1.7.5
Nginxui Nginx Ui	Version 1.7.6
Nginxui Nginx Ui	Version 1.7.7
Nginxui Nginx Ui	Version 1.7.8
Nginxui Nginx Ui	Version 1.7.9
Nginxui Nginx Ui	Version 1.8.0
Nginxui Nginx Ui	Version 1.8.1
Nginxui Nginx Ui	Version 1.8.2
Nginxui Nginx Ui	Version 1.8.3
Nginxui Nginx Ui	Version 1.8.4
Nginxui Nginx Ui	Version 1.8.4 patch
Nginxui Nginx Ui	Version 1.9.9-1
Nginxui Nginx Ui	Version 1.9.9-2
Nginxui Nginx Ui	Version 1.9.9-3
Nginxui Nginx Ui	Version 1.9.9-4
Nginxui Nginx Ui	Version 1.9.9
Nginxui Nginx Ui	Version 2.0.0 beta10
Nginxui Nginx Ui	Version 2.0.0 beta10_patch
Nginxui Nginx Ui	Version 2.0.0 beta11
Nginxui Nginx Ui	Version 2.0.0 beta1
Nginxui Nginx Ui	Version 2.0.0 beta2
Nginxui Nginx Ui	Version 2.0.0 beta3
Nginxui Nginx Ui	Version 2.0.0 beta4
Nginxui Nginx Ui	Version 2.0.0 beta4_patch
Nginxui Nginx Ui	Version 2.0.0 beta5
Nginxui Nginx Ui	Version 2.0.0 beta5_patch
Nginxui Nginx Ui	Version 2.0.0 beta6
Nginxui Nginx Ui	Version 2.0.0 beta6_patch2
Nginxui Nginx Ui	Version 2.0.0 beta6_patch
Nginxui Nginx Ui	Version 2.0.0 beta7
Nginxui Nginx Ui	Version 2.0.0 beta8
Nginxui Nginx Ui	Version 2.0.0 beta8_patch
Nginxui Nginx Ui	Version 2.0.0 beta9

Related CWEs

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (2)

https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-xvq9-4vpv-227m

Source: security-advisories@github.com

Third Party Advisory

https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-xvq9-4vpv-227m

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.