CVE-2024-23827

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-23827

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-23827.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-23827

Aliases

Published

2024-01-29T16:07:13.953Z

Modified

2026-08-12T03:51:23.645127995Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Nginx-UI arbitrary file write through the Import Certificate feature

Details

Nginx-UI is a web interface to manage Nginx configurations. The Import Certificate feature allows arbitrary write into the system. The feature does not check if the provided user input is a certification/key and allows to write into arbitrary paths in the system. It's possible to leverage the vulnerability into a remote code execution overwriting the config file app.ini. Version 2.0.0.beta.12 fixed the issue.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23827.json"
}

References

Affected packages

Git / github.com/0xjacky/nginx-ui

Affected ranges

Type

GIT

Repo

https://github.com/0xjacky/nginx-ui

Events

Introduced

8b60d61b8e54db17590e30b2f21ae6759c9fa89a

Fixed

0381d2290cc3bf309cfb9745f2b930d603e219eb

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.0.0.beta.12"
        },
        {
            "introduced": "1.2.0-NA"
        },
        {
            "last_affected": "1.2.0-NA"
        },
        {
            "introduced": "1.2.1"
        },
        {
            "last_affected": "1.2.1"
        },
        {
            "introduced": "1.2.2"
        },
        {
            "last_affected": "1.2.2"
        },
        {
            "introduced": "1.3.0-NA"
        },
        {
            "last_affected": "1.3.0-NA"
        },
        {
            "introduced": "1.3.0-rc1"
        },
        {
            "last_affected": "1.3.0-rc1"
        },
        {
            "introduced": "1.3.1-NA"
        },
        {
            "last_affected": "1.3.1-NA"
        },
        {
            "introduced": "1.3.1-fix"
        },
        {
            "last_affected": "1.3.1-fix"
        },
        {
            "introduced": "1.3.2"
        },
        {
            "last_affected": "1.3.2"
        },
        {
            "introduced": "1.3.3-rc1"
        },
        {
            "last_affected": "1.3.3-rc1"
        },
        {
            "introduced": "1.4.0-NA"
        },
        {
            "last_affected": "1.4.0-NA"
        },
        {
            "introduced": "1.4.0-rc1"
        },
        {
            "last_affected": "1.4.0-rc1"
        },
        {
            "introduced": "1.4.1"
        },
        {
            "last_affected": "1.4.1"
        },
        {
            "introduced": "1.4.2"
        },
        {
            "last_affected": "1.4.2"
        },
        {
            "introduced": "1.5.0-NA"
        },
        {
            "last_affected": "1.5.0-NA"
        },
        {
            "introduced": "1.5.0-beta1"
        },
        {
            "last_affected": "1.5.0-beta1"
        },
        {
            "introduced": "1.5.0-beta2"
        },
        {
            "last_affected": "1.5.0-beta2"
        },
        {
            "introduced": "1.5.0-beta3"
        },
        {
            "last_affected": "1.5.0-beta3"
        },
        {
            "introduced": "1.5.0-beta4"
        },
        {
            "last_affected": "1.5.0-beta4"
        },
        {
            "introduced": "1.5.0-beta4_fix"
        },
        {
            "last_affected": "1.5.0-beta4_fix"
        },
        {
            "introduced": "1.5.0-beta5"
        },
        {
            "last_affected": "1.5.0-beta5"
        },
        {
            "introduced": "1.5.0-beta6"
        },
        {
            "last_affected": "1.5.0-beta6"
        },
        {
            "introduced": "1.5.0-beta7"
        },
        {
            "last_affected": "1.5.0-beta7"
        },
        {
            "introduced": "1.5.0-beta8"
        },
        {
            "last_affected": "1.5.0-beta8"
        },
        {
            "introduced": "1.5.0-beta9"
        },
        {
            "last_affected": "1.5.0-beta9"
        },
        {
            "introduced": "1.5.1"
        },
        {
            "last_affected": "1.5.1"
        },
        {
            "introduced": "1.5.2"
        },
        {
            "last_affected": "1.5.2"
        },
        {
            "introduced": "1.6.0-NA"
        },
        {
            "last_affected": "1.6.0-NA"
        },
        {
            "introduced": "1.6.0-fix"
        },
        {
            "last_affected": "1.6.0-fix"
        },
        {
            "introduced": "1.6.1"
        },
        {
            "last_affected": "1.6.1"
        },
        {
            "introduced": "1.6.2"
        },
        {
            "last_affected": "1.6.2"
        },
        {
            "introduced": "1.6.3"
        },
        {
            "last_affected": "1.6.3"
        },
        {
            "introduced": "1.6.5"
        },
        {
            "last_affected": "1.6.5"
        },
        {
            "introduced": "1.6.6"
        },
        {
            "last_affected": "1.6.6"
        },
        {
            "introduced": "1.6.7"
        },
        {
            "last_affected": "1.6.7"
        },
        {
            "introduced": "1.6.8"
        },
        {
            "last_affected": "1.6.8"
        },
        {
            "introduced": "1.7.0-NA"
        },
        {
            "last_affected": "1.7.0-NA"
        },
        {
            "introduced": "1.7.0-patch"
        },
        {
            "last_affected": "1.7.0-patch"
        },
        {
            "introduced": "1.7.1"
        },
        {
            "last_affected": "1.7.1"
        },
        {
            "introduced": "1.7.2"
        },
        {
            "last_affected": "1.7.2"
        },
        {
            "introduced": "1.7.3"
        },
        {
            "last_affected": "1.7.3"
        },
        {
            "introduced": "1.7.4"
        },
        {
            "last_affected": "1.7.4"
        },
        {
            "introduced": "1.7.5"
        },
        {
            "last_affected": "1.7.5"
        },
        {
            "introduced": "1.7.6"
        },
        {
            "last_affected": "1.7.6"
        },
        {
            "introduced": "1.7.7"
        },
        {
            "last_affected": "1.7.7"
        },
        {
            "introduced": "1.7.8"
        },
        {
            "last_affected": "1.7.8"
        },
        {
            "introduced": "1.7.9"
        },
        {
            "last_affected": "1.7.9"
        },
        {
            "introduced": "1.8.0"
        },
        {
            "last_affected": "1.8.0"
        },
        {
            "introduced": "1.8.1"
        },
        {
            "last_affected": "1.8.1"
        },
        {
            "introduced": "1.8.2"
        },
        {
            "last_affected": "1.8.2"
        },
        {
            "introduced": "1.8.3"
        },
        {
            "last_affected": "1.8.3"
        },
        {
            "introduced": "1.8.4-NA"
        },
        {
            "last_affected": "1.8.4-NA"
        },
        {
            "introduced": "1.8.4-patch"
        },
        {
            "last_affected": "1.8.4-patch"
        },
        {
            "introduced": "1.9.9"
        },
        {
            "last_affected": "1.9.9"
        },
        {
            "introduced": "1.9.9-1"
        },
        {
            "last_affected": "1.9.9-1"
        },
        {
            "introduced": "1.9.9-2"
        },
        {
            "last_affected": "1.9.9-2"
        },
        {
            "introduced": "1.9.9-3"
        },
        {
            "last_affected": "1.9.9-3"
        },
        {
            "introduced": "1.9.9-4"
        },
        {
            "last_affected": "1.9.9-4"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_STRING"
    ],
    "cpe": [
        "cpe:2.3:a:nginxui:nginx_ui:1.2.0:-:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.2.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.2.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.3.0:-:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.3.0:rc1:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.3.1:-:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.3.1:fix:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.3.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.3.3:rc1:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.4.0:-:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.4.0:rc1:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.4.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.4.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.5.0:-:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.5.0:beta1:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.5.0:beta2:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.5.0:beta3:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.5.0:beta4:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.5.0:beta4_fix:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.5.0:beta5:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.5.0:beta6:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.5.0:beta7:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.5.0:beta8:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.5.0:beta9:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.5.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.5.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.6.0:-:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.6.0:fix:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.6.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.6.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.6.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.6.5:*:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.6.6:*:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.6.7:*:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.6.8:*:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.7.0:-:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.7.0:patch:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.7.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.7.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.7.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.7.4:*:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.7.5:*:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.7.6:*:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.7.7:*:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.7.8:*:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.7.9:*:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.8.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.8.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.8.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.8.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.8.4:-:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.8.4:patch:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.9.9:*:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.9.9-1:*:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.9.9-2:*:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.9.9-3:*:*:*:*:*:*:*",
        "cpe:2.3:a:nginxui:nginx_ui:1.9.9-4:*:*:*:*:*:*:*"
    ]
}

Affected versions

1.*

1.2.0-NA

1.2.1

1.2.2

1.3.0-NA

1.3.0-rc1

1.3.1-NA

1.3.2

1.3.3-rc1

1.4.0-NA

1.4.0-rc1

1.4.1

1.4.2

1.5.0-NA

1.5.0-beta1

1.5.0-beta2

1.5.0-beta3

1.5.0-beta4

1.5.0-beta5

1.5.0-beta6

1.5.0-beta7

1.5.0-beta8

1.5.0-beta9

1.5.1

1.5.2

1.6.0-NA

1.6.1

1.6.2

1.6.3

1.6.5

1.6.6

1.6.7

1.6.8

1.7.0-NA

1.7.1

1.7.2

1.7.3

1.7.4

1.7.5

1.7.6

1.7.7

1.7.8

1.7.9

1.8.0

1.8.1

1.8.2

1.8.3

1.8.4-NA

1.9.9

1.9.9-1

1.9.9-2

1.9.9-3

1.9.9-4

v1.*

v1.2.0

v1.2.0-rc.3

v1.2.1

v1.2.2

v1.3.0

v1.3.0-rc1

v1.3.1

v1.3.1-fix

v1.3.2

v1.3.3-rc1

v1.4.0

v1.4.0-rc1

v1.4.1

v1.4.2

v1.5.0

v1.5.0-beta1

v1.5.0-beta2

v1.5.0-beta3

v1.5.0-beta4

v1.5.0-beta4-fix

v1.5.0-beta5

v1.5.0-beta6

v1.5.0-beta7

v1.5.0-beta8

v1.5.0-beta9

v1.5.1

v1.5.2

v1.6.0

v1.6.0-fix

v1.6.1

v1.6.2

v1.6.3

v1.6.5

v1.6.6

v1.6.7

v1.6.8

v1.7.0

v1.7.0-patch

v1.7.1

v1.7.2

v1.7.3

v1.7.4

v1.7.5

v1.7.6

v1.7.7

v1.7.8

v1.7.9

v1.8.0

v1.8.1

v1.8.2

v1.8.3

v1.8.4

v1.8.4-patch

v1.9.9

v1.9.9-1

v1.9.9-2

v1.9.9-3

v1.9.9-4

v2.*

v2.0.0-beta.1

v2.0.0-beta.10

v2.0.0-beta.10-patch

v2.0.0-beta.11

v2.0.0-beta.2

v2.0.0-beta.3

v2.0.0-beta.4

v2.0.0-beta.4-patch

v2.0.0-beta.5

v2.0.0-beta.5-patch

v2.0.0-beta.6

v2.0.0-beta.6-patch

v2.0.0-beta.6-patch.2

v2.0.0-beta.7

v2.0.0-beta.8

v2.0.0-beta.8-patch

v2.0.0-beta.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-23827.json"