high CVSS 8.8

CVE-2024-39935·Nginx vulnerability

jc21 NGINX Proxy Manager before 2.11.3 allows backend/internal/certificate.js OS command injection by an authenticated user (with certificate management privileges) via untrusted input to the DNS provider configuration. NOTE: this is not part of any NGINX software shipped by F5.

Severity
high
Software
Nginx
Fixed in
2.11.3
Published
2024-07-04

Affected versions

Until: 2.11.3

Fixed in: 2.11.3

How to fix this CVE

Update NGINX Proxy Manager to version 2.11.3 or later to patch a critical command injection vulnerability in the certificate management module. The vulnerability allows authenticated users with certificate management privileges to execute arbitrary OS commands through malicious DNS provider configuration input. Immediate patching is recommended to prevent privilege escalation and system compromise.

sudo dnf update nginx-proxy-manager

Defensia detects this vulnerability

How to check if you are affected

  1. Check installed NGINX Proxy Manager version: dpkg -l | grep nginx-proxy-manager or rpm -qa | grep nginx-proxy-manager
  2. Verify the certificate management service is running: systemctl status nginx-proxy-manager
  3. Search logs for DNS provider configuration changes: grep -i 'dns\|certificate\|provider' /var/log/nginx-proxy-manager/*.log | grep -i 'modified\|updated\|created'
  4. Confirm patch installation by running nginx-proxy-manager --version or checking /opt/nginx-proxy-manager/package.json for version >= 2.11.3

FAQ

What is CVE-2024-39935?

CVE-2024-39935 is an OS command injection vulnerability in NGINX Proxy Manager's certificate management module that allows authenticated users with certificate privileges to execute arbitrary commands by injecting malicious payloads into DNS provider configuration fields.

Is CVE-2024-39935 being actively exploited?

No, CVE-2024-39935 is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and no public exploits are available. However, the vulnerability should still be patched promptly due to its high severity (CVSS 8.8) and the authentication context in which it occurs.

What versions of NGINX Proxy Manager are affected by CVE-2024-39935?

All versions of NGINX Proxy Manager prior to version 2.11.3 are vulnerable. Version 2.11.3 and later include the security fix.

How do I check if my server is vulnerable to CVE-2024-39935?

Run 'nginx-proxy-manager --version' or 'cat /opt/nginx-proxy-manager/package.json | grep version' to determine your installed version. If the version is below 2.11.3, your system is vulnerable.

Does Defensia detect CVE-2024-39935?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If NGINX Proxy Manager is installed on a monitored server, CVE-2024-39935 will appear in your dashboard with remediation steps.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2024-39935. Free for 1 server.

Get started free