CVE-2024-23828 Nginx-UI authenticated RCE through injecting into the application config via CRLF

What is CVE-2024-23828?

CVE-2024-23828 is a high-severity command injection vulnerability in 0xJacky nginx-ui, published on 29 Jan 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Nginx-UI is a web interface to manage Nginx configurations. It is vulnerable to an authenticated arbitrary command execution via CRLF attack when changing the value of test_config_cmd or start_cmd. This vulnerability exists due to an incomplete fix for CVE-2024-22197 and CVE-2024-22198. This vulnerability has been patched in version 2.0.0.beta.12.

Weakness: CWE-74

Which versions are affected by CVE-2024-23828?

3 open source packages ship an affected version, including github.com/0xJacky/Nginx-UI. It affects 1 product.

Products include Nginxui Nginx Ui.

How do I fix CVE-2024-23828?

Upgrade github.com/0xJacky/Nginx-UI to 1.9.10-0.20240126104956-d70e37c8575e or later.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2024-23828 being exploited?

There is no known exploitation of CVE-2024-23828 in the wild and no public exploit code.

Other vulnerabilities in 0xJacky nginx-ui

• CVE-2026-33032 Nginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx Takeover Critical 9.8
• CVE-2026-27944 Nginx UI: Unauthenticated Backup Download with Encryption Key Disclosure Critical 9.8
• CVE-2024-23827 Nginx-UI arbitrary file write through the Import Certificate feature Critical 9.8
• CVE-2026-107806 Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite Critical 9.4
• CVE-2026-33026 nginx-ui Backup Restore Allows Tampering with Encrypted Backups Critical 9.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qcjq-7f7v-pvc8, GO-2024-2480.