Read the docs
TI-2024-15822 Aliases CVE-2024-23828GHSA-qcjq-7f7v-pvc8

Nginx-UI authenticated RCE through injecting into the application config via CRLF

Priority MEDIUM 42CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Nginx-UI is a web interface to manage Nginx configurations. It is vulnerable to an authenticated arbitrary command execution via CRLF attack when changing the value of test_config_cmd or start_cmd. This vulnerability exists due to an incomplete fix for CVE-2024-22197 and CVE-2024-22198. This vulnerability has been patched in version 2.0.0.beta.12.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01054 64th percentileScored 2026-11-07
Fix Fixed nginx-ui (0xJacky): v2.0.0.beta.12github.com/0xJacky/Nginx-UI (Go): 1.9.10-0.20240126104956-d70e37c8575e

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
0xJackynginx-uibefore v2.0.0.beta.12v2.0.0.beta.12Patch availableCNA
—github.com/0xJacky/Nginx-UI (Go)before 1.9.10-0.20240126104956-d70e37c8575e1.9.10-0.20240126104956-d70e37c8575ePatch availableGHSA-qcjq-7f7v-pvc8
  • nginx-ui Vendor0xJacky Affected before v2.0.0.beta.12 Fixed in v2.0.0.beta.12 Patch available CNA
  • github.com/0xJacky/Nginx-UI (Go) Vendor— Affected before 1.9.10-0.20240126104956-d70e37c8575e Fixed in 1.9.10-0.20240126104956-d70e37c8575e Patch available GHSA-qcjq-7f7v-pvc8

CPE configurations NVD · 18

CPEVersionsRoleVendor
cpe:2.3:a:nginxui:nginx_ui:*:*:*:*:*:*:*:*before 2.0.0Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta1:*:*:*:*:*:*2.0.0 beta1Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta10:*:*:*:*:*:*2.0.0 beta10Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta10_patch:*:*:*:*:*:*2.0.0 beta10_patchVulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta11:*:*:*:*:*:*2.0.0 beta11Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta2:*:*:*:*:*:*2.0.0 beta2Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta3:*:*:*:*:*:*2.0.0 beta3Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta4:*:*:*:*:*:*2.0.0 beta4Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta4_patch:*:*:*:*:*:*2.0.0 beta4_patchVulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta5:*:*:*:*:*:*2.0.0 beta5Vulnerable0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:*:*:*:*:*:*:*:* Versions before 2.0.0 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta1:*:*:*:*:*:* Versions 2.0.0 beta1 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta10:*:*:*:*:*:* Versions 2.0.0 beta10 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta10_patch:*:*:*:*:*:* Versions 2.0.0 beta10_patch Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta11:*:*:*:*:*:* Versions 2.0.0 beta11 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta2:*:*:*:*:*:* Versions 2.0.0 beta2 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta3:*:*:*:*:*:* Versions 2.0.0 beta3 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta4:*:*:*:*:*:* Versions 2.0.0 beta4 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta4_patch:*:*:*:*:*:* Versions 2.0.0 beta4_patch Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta5:*:*:*:*:*:* Versions 2.0.0 beta5 Vulnerable ·0xJacky
Show 8 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta5_patch:*:*:*:*:*:*2.0.0 beta5_patchVulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta6:*:*:*:*:*:*2.0.0 beta6Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta6_patch:*:*:*:*:*:*2.0.0 beta6_patchVulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta6_patch2:*:*:*:*:*:*2.0.0 beta6_patch2Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta7:*:*:*:*:*:*2.0.0 beta7Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta8:*:*:*:*:*:*2.0.0 beta8Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta8_patch:*:*:*:*:*:*2.0.0 beta8_patchVulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta9:*:*:*:*:*:*2.0.0 beta9Vulnerable0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta5_patch:*:*:*:*:*:* Versions 2.0.0 beta5_patch Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta6:*:*:*:*:*:* Versions 2.0.0 beta6 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta6_patch:*:*:*:*:*:* Versions 2.0.0 beta6_patch Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta6_patch2:*:*:*:*:*:* Versions 2.0.0 beta6_patch2 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta7:*:*:*:*:*:* Versions 2.0.0 beta7 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta8:*:*:*:*:*:* Versions 2.0.0 beta8 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta8_patch:*:*:*:*:*:* Versions 2.0.0 beta8_patch Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta9:*:*:*:*:*:* Versions 2.0.0 beta9 Vulnerable ·0xJacky

Remediation

  • Fix · CNA nginx-ui (0xJacky) Fixed in v2.0.0.beta.12
  • Fix · GHSA-qcjq-7f7v-pvc8 github.com/0xJacky/Nginx-UI (Go) Fixed in 1.9.10-0.20240126104956-d70e37c8575e Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-23828
  2. 2026-10-03 Alias added: GHSA-qcjq-7f7v-pvc8

References

Advisory 2

Other 3

  • TI-2026-25478 Nginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx Takeover CVSS 3.1CRITICAL 9.8
  • TI-2026-25472 nginx-ui Backup Restore Allows Tampering with Encrypted Backups CVSS 4.0CRITICAL 9.4
  • TI-2026-22288 Nginx UI: Unauthenticated Backup Download with Encryption Key Disclosure CVSS 3.1CRITICAL 9.8
  • TI-2024-15821 Nginx-UI arbitrary file write through the Import Certificate feature CVSS 3.1CRITICAL 9.8
  • TI-2026-70057 Code injection in Nginx UI backup restore allows code execution CVSS 4.0CRITICAL 9.4
  • TI-2026-32056 Nginx UI: Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware Allows Access to Internal Services CVSS 3.1CRITICAL 9.9
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences