CVE-2024-46256

Vulnerability

A command injection vulnerability exists in the requestLetsEncryptSsl function of NginxProxyManager version 2.11.3. The flaw resides in backend/internal/certificate.js where DNS provider credentials (dns_provider_credentials) are concatenated into a shell command without proper sanitization. Prior to the fix, the code escaped single quotes and backslashes but still embedded user-supplied credentials directly into a sh -c command string, allowing injection of arbitrary shell metacharacters. The affected code path is triggered when a user requests a Let's Encrypt SSL certificate with a custom DNS provider that requires credentials. No special privileges or configurations beyond default settings are required.

Exploitation

An attacker needs network access to the NginxProxyManager web interface and must be able to authenticate (or use a valid session token) to reach the certificate request feature. The exploit involves sending a malicious request to the /api/nginx/certificates endpoint with crafted dns_provider_credentials containing shell injection payloads. Public proof-of-concept code demonstrates sending a base64-encoded command that downloads a reverse shell payload (e.g., nc), makes it executable, and then connects back to an attacker-controlled host. The injection occurs because the credentials string is interpolated into a sh -c command line that writes the credentials file and sets permissions [1][3][4].

Impact

Successful exploitation results in remote code execution (RCE) as the nginx-proxy-manager process user (typically nobody or similar). An attacker can execute arbitrary operating system commands, potentially leading to full compromise of the application server, including data exfiltration, installation of backdoors, or lateral movement within the network. The vulnerability also enables privilege escalation if the process runs with elevated capabilities or misconfigured container escapes [1][3].

Mitigation

The vulnerability was fixed in NginxProxyManager version 2.12.0, released as part of the merge pull request #4073 on September 9, 2024. The fix replaces the dangerous shell command with safe filesystem operations using fs.writeFileSync and fs.unlink, eliminating the command injection vector. Users are strongly advised to upgrade to v2.12.0 or later. No workaround is available for v2.11.3. The CVE is not listed in the KEV catalog as of the publication date [1][2][3][4].