# CVE-2024-23828: 0xJacky Nginx-UI authenticated RCE via CRLF injection in app.ini

Source: https://junglewise.ai/threats/cve-2024-23828-0xjacky-nginx-ui-authenticated-rce-via-crlf-injection-in-app-ini  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-01-29. Updated: 2026-07-06  
License: CC BY 4.0 with a link back

CVE-2024-23828 · Severity: high · CVSS 8.8 · Published 2024-01-29

Nginx-UI is a web-based management interface for the Nginx web server. A vulnerability allows an authenticated user to inject malicious commands into the application's configuration file. If exploited, an attacker can gain full control over the host system, potentially leading to data theft, service disruption, or further network compromise.

Technologies: [0xJacky Nginx-UI](https://junglewise.ai/threats/technologies/nginx-ui), [github.com/0xJacky/Nginx-UI (Go)](https://junglewise.ai/threats/technologies/github-com-0xjacky-nginx-ui). Vendors: [0xJacky](https://junglewise.ai/threats/vendors/0xjacky), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2024-23828 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-23828 being exploited in the wild.

**How severe is CVE-2024-23828?** High severity, with a CVSS score of 8.8, published 29 January 2024.

**Which products and versions are affected?** 0xJacky Nginx-UI < 1.9.10-0.20240126104956-d70e37c8575e; github.com/0xJacky/Nginx-UI (Go) < 1.9.10-0.20240126104956-d70e37c8575e, SEMVER:introduced=0, SEMVER:introduced=0,fixed=1.9.10-0.20240126104956-d70e37c8575e.

**Is there a fix for CVE-2024-23828?** Yes. github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20240126104956-d70e37c8575e or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-23828 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2024-23828?** Check whether you run 0xJacky Nginx-UI or github.com/0xJacky/Nginx-UI (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20240126104956-d70e37c8575e or later

  ```sh
  go get github.com/0xJacky/Nginx-UI@v1.9.10-0.20240126104956-d70e37c8575e
  ```


## Technical details

Nginx-UI is vulnerable to a CRLF injection vulnerability in its configuration management component. An authenticated attacker with low privileges can inject carriage return and line feed (CRLF) characters into the application's configuration file (app.ini). This allows the attacker to overwrite sensitive configuration values, specifically 'test_config_cmd' and 'start_cmd'. By modifying these commands, the attacker can achieve remote code execution (RCE) on the underlying host. This vulnerability is a bypass for previous fixes (GHSA-pxmr-q2x3-9x9m and GHSA-8r25-68wm-jw35) and is addressed in version 1.9.10-0.20240126104956-d70e37c8575e.

## Affected products

- 0xJacky Nginx-UI < 1.9.10-0.20240126104956-d70e37c8575e

## Identifiers

- CVE-2024-23828
- GHSA-qcjq-7f7v-pvc8
- GO-2024-2480

## Timeline

- 2024-01-28: disclosed
- 2024-01-29: advisory
- 2024-01-29: patched

## References

- [https://api.github.com/users/Elleuch-x1](https://api.github.com/users/Elleuch-x1)
- [https://github.com/Elleuch-x1](https://github.com/Elleuch-x1)
- [https://api.github.com/users/Elleuch-x1/gists%7B/gist_id%7D](https://api.github.com/users/Elleuch-x1/gists%7B/gist_id%7D)
- [https://api.github.com/users/Elleuch-x1/repos](https://api.github.com/users/Elleuch-x1/repos)
- [https://avatars.githubusercontent.com/u/26652608?v=4](https://avatars.githubusercontent.com/u/26652608?v=4)
- [https://api.github.com/users/Elleuch-x1/events%7B/privacy%7D](https://api.github.com/users/Elleuch-x1/events%7B/privacy%7D)

## Related threats

- [Nginx UI Casdoor SSO login CSRF via constant state parameter](https://junglewise.ai/threats/cve-2026-84312-nginx-ui-casdoor-sso-callback-uses-a-constant-state-parameter)
- [Nginx UI OTP secure-session step-up bypass via MCP](https://junglewise.ai/threats/cve-2026-84360-nginx-ui-otp-secure-session-step-up-can-be-bypassed-via-mcp)
- [Nginx UI short token cache bypass after account re-enable](https://junglewise.ai/threats/cve-2026-84321-nginx-ui-standalone-short-tokens-survive-administrative)
- [Nginx UI auto backup path traversal in storage boundary](https://junglewise.ai/threats/cve-2026-84320-nginx-ui-auto-backup-name-allows-path-traversal-outside-validated)
- [Nginx UI MCP configuration directive validation bypass](https://junglewise.ai/threats/cve-2026-84319-nginx-ui-mcp-configuration-tools-bypass-restricted-directive)