Is CVE-2024-23828 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-23828 being exploited in the wild.

How severe is CVE-2024-23828?

High severity, with a CVSS score of 8.8, published 29 January 2024.

Which products and versions are affected?

0xJacky Nginx-UI < 1.9.10-0.20240126104956-d70e37c8575e; github.com/0xJacky/Nginx-UI (Go) < 1.9.10-0.20240126104956-d70e37c8575e, SEMVER:introduced=0, SEMVER:introduced=0,fixed=1.9.10-0.20240126104956-d70e37c8575e.

Is there a fix for CVE-2024-23828?

Yes. github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20240126104956-d70e37c8575e or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-23828 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2024-23828?

Check whether you run 0xJacky Nginx-UI or github.com/0xJacky/Nginx-UI (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-23828: 0xJacky Nginx-UI authenticated RCE via CRLF injection in app.ini

Q: Which products and versions are affected?

0xJacky Nginx-UI < 1.9.10-0.20240126104956-d70e37c8575e; github.com/0xJacky/Nginx-UI (Go) < 1.9.10-0.20240126104956-d70e37c8575e, SEMVER:introduced=0, SEMVER:introduced=0,fixed=1.9.10-0.20240126104956-d70e37c8575e.

Q: Is there a fix for CVE-2024-23828?

Yes. github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20240126104956-d70e37c8575e or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2024-23828 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2024-23828?

Check whether you run 0xJacky Nginx-UI or github.com/0xJacky/Nginx-UI (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-23828 · Severity: high · CVSS 8.8 · Published 2024-01-29

Nginx-UI is a web-based management interface for the Nginx web server. A vulnerability allows an authenticated user to inject malicious commands into the application's configuration file. If exploited, an attacker can gain full control over the host system, potentially leading to data theft, service disruption, or further network compromise.

Technologies: 0xJacky Nginx-UI, github.com/0xJacky/Nginx-UI (Go). Vendors: 0xJacky, Go.

Quick answers

Is CVE-2024-23828 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-23828 being exploited in the wild.
How severe is CVE-2024-23828?: High severity, with a CVSS score of 8.8, published 29 January 2024.
Which products and versions are affected?: 0xJacky Nginx-UI < 1.9.10-0.20240126104956-d70e37c8575e; github.com/0xJacky/Nginx-UI (Go) < 1.9.10-0.20240126104956-d70e37c8575e, SEMVER:introduced=0, SEMVER:introduced=0,fixed=1.9.10-0.20240126104956-d70e37c8575e.
Is there a fix for CVE-2024-23828?: Yes. github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20240126104956-d70e37c8575e or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-23828 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2024-23828?: Check whether you run 0xJacky Nginx-UI or github.com/0xJacky/Nginx-UI (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20240126104956-d70e37c8575e or later
```
go get github.com/0xJacky/Nginx-UI@v1.9.10-0.20240126104956-d70e37c8575e
```

Technical details

Nginx-UI is vulnerable to a CRLF injection vulnerability in its configuration management component. An authenticated attacker with low privileges can inject carriage return and line feed (CRLF) characters into the application's configuration file (app.ini). This allows the attacker to overwrite sensitive configuration values, specifically 'test_config_cmd' and 'start_cmd'. By modifying these commands, the attacker can achieve remote code execution (RCE) on the underlying host. This vulnerability is a bypass for previous fixes (GHSA-pxmr-q2x3-9x9m and GHSA-8r25-68wm-jw35) and is addressed in version 1.9.10-0.20240126104956-d70e37c8575e.

Affected products

0xJacky Nginx-UI < 1.9.10-0.20240126104956-d70e37c8575e

Identifiers

CVE-2024-23828
GHSA-qcjq-7f7v-pvc8
GO-2024-2480

Timeline

2024-01-28: disclosed
2024-01-29: advisory
2024-01-29: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.