Is CVE-2024-23827 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-23827 being exploited in the wild.

How severe is CVE-2024-23827?

Critical severity, with a CVSS score of 9.8, published 29 January 2024.

Which products and versions are affected?

0xJacky Nginx-UI < 1.9.10-0.20240128060047-8581bdd3c6f4; github.com/0xJacky/Nginx-UI (Go) < 1.9.10-0.20240128060047-8581bdd3c6f4, SEMVER:introduced=0, SEMVER:introduced=0,fixed=1.9.10-0.20240128060047-8581bdd3c6f4.

Is there a fix for CVE-2024-23827?

Yes. github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20240128060047-8581bdd3c6f4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-23827 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2024-23827?

Check whether you run 0xJacky Nginx-UI or github.com/0xJacky/Nginx-UI (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-23827: 0xJacky Nginx-UI arbitrary file write in Import Certificate feature

Q: Which products and versions are affected?

0xJacky Nginx-UI < 1.9.10-0.20240128060047-8581bdd3c6f4; github.com/0xJacky/Nginx-UI (Go) < 1.9.10-0.20240128060047-8581bdd3c6f4, SEMVER:introduced=0, SEMVER:introduced=0,fixed=1.9.10-0.20240128060047-8581bdd3c6f4.

Q: Is there a fix for CVE-2024-23827?

Yes. github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20240128060047-8581bdd3c6f4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2024-23827 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2024-23827?

Check whether you run 0xJacky Nginx-UI or github.com/0xJacky/Nginx-UI (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-23827 · Severity: critical · CVSS 9.8 · Published 2024-01-29

Nginx-UI, a web-based management interface for Nginx, contains a vulnerability in its certificate import feature. An attacker can use this flaw to write or overwrite any file on the server's filesystem. This could allow an attacker to take full control of the server, potentially leading to data theft or service disruption.

Technologies: 0xJacky Nginx-UI, github.com/0xJacky/Nginx-UI (Go). Vendors: 0xJacky, Go.

Quick answers

Is CVE-2024-23827 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-23827 being exploited in the wild.
How severe is CVE-2024-23827?: Critical severity, with a CVSS score of 9.8, published 29 January 2024.
Which products and versions are affected?: 0xJacky Nginx-UI < 1.9.10-0.20240128060047-8581bdd3c6f4; github.com/0xJacky/Nginx-UI (Go) < 1.9.10-0.20240128060047-8581bdd3c6f4, SEMVER:introduced=0, SEMVER:introduced=0,fixed=1.9.10-0.20240128060047-8581bdd3c6f4.
Is there a fix for CVE-2024-23827?: Yes. github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20240128060047-8581bdd3c6f4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-23827 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2024-23827?: Check whether you run 0xJacky Nginx-UI or github.com/0xJacky/Nginx-UI (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20240128060047-8581bdd3c6f4 or later
```
go get github.com/0xJacky/Nginx-UI@v1.9.10-0.20240128060047-8581bdd3c6f4
```

Technical details

A path traversal and arbitrary file write vulnerability exists in Nginx-UI's 'Import Certificate' feature. The `AddCert` function in `api/certificate/certificate.go` accepts user-provided file paths for SSL certificates and keys without validation. These paths are passed directly to `os.MkdirAll` and `os.WriteFile`, allowing an unauthenticated or authenticated attacker (depending on deployment configuration) to write arbitrary content to any location on the host filesystem. By overwriting sensitive configuration files like `app.ini` and modifying startup commands, an attacker can achieve remote code execution (RCE) upon application restart. The vulnerability is addressed in version 1.9.10-0.20240128060047-8581bdd3c6f4.

Affected products

0xJacky Nginx-UI < 1.9.10-0.20240128060047-8581bdd3c6f4

Identifiers

CVE-2024-23827
GHSA-xvq9-4vpv-227m
GO-2024-2481

Timeline

2024-01-28: disclosed
2024-01-29: advisory
2024-01-29: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.