NginxProxyManager
CVE-2024-46257
Just to bring more visibility to this major bug that was reported. Link includes multiple references on where exactly the issue is and how to reproduce the issue.
https://www.tenable.com/cve/CVE-2024-46257
The maintainer basically never actually check github issue. Please email it directly to him at [email protected] Hopefully this resolve faster than last time (which took 4 months).
Hi everyone,
could someone shed a bit more light on how severe this problem is?
Doest this only concern instances of NPM which are exposed to internet or virtually all installations, including the ones behind firewalls?
From the information seen on the CVE, it looks like if someone is able to request a Let's Encrypt cert, they are able to exploit this bug. I'm unsure if there's anything external that calls those endpoints an unauthenticated user can exploit, but I have emailed jc and got confirmation that he'll look into the issue as soon as he can.
Hello, I am the person who submitted the above CVE, you can refer to my article here: https://viblo.asia/p/phat-hien-rce-nhung-ban-phai-dang-nhap-truoc-da-cau-chuyen-cve-cua-minh-voi-56000-host-MkNLrQaOJgA
