kimtangker/CVE-2024-46256

GitHubRepository PoCExploit

PoC files

9 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that authenticates to Nginx Proxy Manager 2.11.3 and exploits CVE-2024-46256, a command injection vulnerability in the Let's Encrypt certificate request, to achieve remote code execution by downloading and executing a reverse shell payload.

Backdoor review

No backdoor observed in reviewed code

The PoC script (poc_cve_2024_46256_Tool.py) is a straightforward exploit for CVE-2024-46256. It authenticates to Nginx Proxy Manager, sends a command injection payload via the Let's Encrypt certificate API, and offers version checking, vulnerability verification, and reverse shell execution. All actions are directly related to the claimed vulnerability and are operator-initiated. No concealed, deceptive, or unrelated harmful behavior is present.

ClassificationExploit
Model confidence95%
AuthenticationRequired
Languagespython
Target softwareNginx Proxy Manager
Attack typescommand injectionremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script contains a function execute_rce that constructs a command injection payload and sends it to the vulnerable endpoint, and functions vulncheck and exploit that use this to download and execute a reverse shell, which constitutes exploitation code.

poc_cve_2024_46256_Tool.py:53-69poc_cve_2024_46256_Tool.py:175-202

Requirements

  • Valid credentials for the Nginx Proxy Manager web interface are required to obtain an API token.poc_cve_2024_46256_Tool.py:37-50
  • An attacker-controlled HTTP server must be running to serve a reverse shell payload named 'rev'.poc_cve_2024_46256_Tool.py:175-182

Observed behavior

  • Prompts the user for target URL, credentials, and attacker IP/port, then authenticates to obtain a Bearer token.poc_cve_2024_46256_Tool.py:37-50poc_cve_2024_46256_Tool.py:220-231
  • Sends a crafted JSON payload to /api/nginx/certificates with a domain name containing shell metacharacters to inject an arbitrary command.poc_cve_2024_46256_Tool.py:53-69
  • Downloads a reverse shell binary from the attacker's server to /tmp/rev and makes it executable via injected curl and chmod commands.poc_cve_2024_46256_Tool.py:175-190
  • Executes the downloaded reverse shell payload on the target upon user confirmation.poc_cve_2024_46256_Tool.py:193-202
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Command Injection Payload
domain_names: ['test.com"||{cmd}||\\n test.com"']The script constructs a command injection payload in the domain_names field to achieve RCE, consistent with the CVE description.poc_cve_2024_46256_Tool.py:55
Reverse Shell Execution
Executes /tmp/rev after downloading from attacker-controlled serverThe exploit function prompts the operator to start a listener and then executes a pre-staged reverse shell binary, which is standard post-exploitation behavior for an RCE PoC.poc_cve_2024_46256_Tool.py:193-202
Logging
Writes actions to poc_actions.logThe script logs actions (login, RCE commands, version check, exit) to a local file, which is a benign operational log and does not exfiltrate data.poc_cve_2024_46256_Tool.py:14-20
Review boundaries

What the analysis did not establish

  • Evidence includes only two text files (README.md and poc_cve_2024_46256_Tool.py) out of nine total files; seven files are omitted and not analyzed.
  • The reverse shell payload 'rev' is not included in the evidence, so its exact behavior cannot be confirmed.
  • Seven files in the repository were omitted from text analysis; their content is unknown.
  • The review is based solely on the supplied text evidence and does not include dynamic analysis or inspection of binary files.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

docker-compose.yml

Created Vuln labCVE-2024-46256Compose · images

1 Compose manifest · 1 service

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment running Nginx Proxy Manager 2.11.3, intended for demonstrating CVE-2024-46256, a remote code execution vulnerability. The environment consists of a single service with exposed HTTP, HTTPS, and admin web interface ports, and bind-mounted data and Let's Encrypt directories.

docker-compose.yml:1-23README.md:1-71

Lab assessment

Vulnerability lab

The README explicitly states the environment is for analyzing CVE-2024-46256, an RCE vulnerability in Nginx Proxy Manager 2.11.3. The Docker Compose file deploys the vulnerable version, and a PoC script is provided to exercise the vulnerability.

README.md:1-3README.md:25-27docker-compose.yml:5
Lab shapeCompose · images
Services1
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

nginx-proxy-manager

vulnerable target service

Runs Nginx Proxy Manager 2.11.3, exposing ports 80, 443, and 81. Uses SQLite database and bind mounts for data and Let's Encrypt certificates. The service is the target for the CVE-2024-46256 RCE exploit.

docker-compose.yml:4-18

poc_cve_2024_46256_Tool.py

exploit scriptvulnerability verification tool

A Python script that logs into the Nginx Proxy Manager web interface, checks the version, verifies vulnerability by attempting command injection via the certificate API, and optionally executes a reverse shell payload. It logs actions to poc_actions.log.

poc_cve_2024_46256_Tool.py:1-258
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2024-46256

Supported by supplied evidence

The README and PoC script both reference CVE-2024-46256 as an RCE in Nginx Proxy Manager 2.11.3. The script implements command injection via the domain_names field in the certificate API, matching the described vulnerability.

README.md:25-27poc_cve_2024_46256_Tool.py:55-68
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to run the environment.README.md:7-9
  • The attacker must have network access to the target Nginx Proxy Manager instance on ports 80, 443, and 81.docker-compose.yml:8-10
  • Valid credentials for the Nginx Proxy Manager admin interface are required (default: admin@example.com / changeme).README.md:17-19
  • For the reverse shell exploit, an attacker-controlled HTTP server serving a 'rev' payload and a netcat listener are needed.poc_cve_2024_46256_Tool.py:155-160

Evidence-described exercise path

  1. Start the vulnerable Nginx Proxy Manager instance using docker-compose up -d.README.md:7-9
  2. Access the admin interface at http://localhost:81 and complete initial setup.README.md:13-15
  3. Run the PoC script (poc_cve_2024_46256_Tool.py) and provide target URL, credentials, and attacker IP/port.poc_cve_2024_46256_Tool.py:200-210
  4. Use the script's menu to perform version check, vulnerability verification (vulncheck), and optional reverse shell execution (exploit).poc_cve_2024_46256_Tool.py:220-240
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The environment is a self-contained vulnerability lab. The PoC script targets only the lab's own Nginx Proxy Manager service. It does not exhibit behavior that escapes the container, compromises the host, or reaches external systems beyond the documented attacker-controlled server used for the reverse shell payload. No hidden persistence, credential theft, or destructive actions are visible.

docker-compose.yml:1-23poc_cve_2024_46256_Tool.py:1-258
Review boundaries

What the analysis did not establish

  • The PoC script references an external attacker-controlled HTTP server and reverse shell listener, which are part of the documented exercise but could be used outside the lab if misconfigured.
  • The script logs actions to a local file (poc_actions.log), which is benign in the lab context but could be considered a local artifact.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1