CVE-2023-23596

jc21 NGINX Proxy Manager through 2.9.19 allows OS command injection. When creating an access list, the backend builds an htpasswd file with crafted username and/or password input that is concatenated without any validation, and is directly passed to the exec command, potentially allowing an authenticated attacker to execute arbitrary commands on the system. NOTE: this is not part of any NGINX software shipped by F5.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://advisory.dw1.io/57	Exploit Third Party Advisory
https://github.com/NginxProxyManager/nginx-proxy-manager/blob/4f10d129c20cc82494b95cc94b97f859dbd4b54d/backend/internal/access-list.js#L510	Exploit Third Party Advisory
https://advisory.dw1.io/57	Exploit Third Party Advisory
https://github.com/NginxProxyManager/nginx-proxy-manager/blob/4f10d129c20cc82494b95cc94b97f859dbd4b54d/backend/internal/access-list.js#L510	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:jc21:nginx_proxy_manager:*:*:*:*:*:*:*:*

History

21 Nov 2024, 07:46

Type	Values Removed	Values Added
References	~~() https://advisory.dw1.io/57 - Exploit, Third Party Advisory~~	() https://advisory.dw1.io/57 - Exploit, Third Party Advisory
References	~~() https://github.com/NginxProxyManager/nginx-proxy-manager/blob/4f10d129c20cc82494b95cc94b97f859dbd4b54d/backend/internal/access-list.js#L510 - Exploit, Third Party Advisory~~	() https://github.com/NginxProxyManager/nginx-proxy-manager/blob/4f10d129c20cc82494b95cc94b97f859dbd4b54d/backend/internal/access-list.js#L510 - Exploit, Third Party Advisory
Summary		(es) jc21 NGINX Proxy Manager hasta 2.9.19 permite la inyección de comandos de sistema operativo. Al crear una lista de acceso, el backend crea un archivo htpasswd con un nombre de usuario y/o contraseña manipulados que se concatena sin ninguna validación y se pasa directamente al comando exec, lo que potencialmente permite que un atacante autenticado ejecute comandos arbitrarios en el sistema. NOTA: esto no forma parte de ningún software NGINX enviado por F5.

Information

Published : 2023-01-20 08:15

Updated : 2024-11-21 07:46

NVD link : CVE-2023-23596

Mitre link : CVE-2023-23596

CVE.ORG link : CVE-2023-23596

JSON object : View

Products Affected

jc21

nginx_proxy_manager

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

8.8 /10