CVE-2024-23828: Nginx-UI vulnerable to authenticated RCE through injecting into the application config via CRLF

January 29, 2024 (updated July 6, 2026)

Fix bypass to the following bugs

https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-pxmr-q2x3-9x9m
https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-8r25-68wm-jw35

Allowing to inject directly in the app.ini via CRLF to change the value of test_config_cmd and start_cmd resulting in an Authenticated RCE

References

github.com/0xJacky/nginx-ui/commit/d70e37c8575e25b3da7203ff06da5e16c77a42d1
github.com/0xJacky/nginx-ui/security/advisories/GHSA-qcjq-7f7v-pvc8
github.com/advisories/GHSA-qcjq-7f7v-pvc8
nvd.nist.gov/vuln/detail/CVE-2024-23828
pkg.go.dev/vuln/GO-2024-2480

Code Behaviors & Features

Detect and mitigate CVE-2024-23828 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →