CVE-2024-46256

CRITICAL
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2024-46256 has a selected CVSS score of 9.8 (critical); EIP currently links 3 repository PoCs and 1 lab environment.

Description

A Command injection vulnerability in requestLetsEncryptSsl in NginxProxyManager 2.11.3 allows an attacker to RCE via Add Let's Encrypt Certificate.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
3
Lab environments
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 3, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

nginx_proxy_manager

Browse nginxproxymanager / nginx_proxy_manager

Default status: unknown

CVE List2.11.3affected

Proofs of concept

3

Repository PoCs

GitHubkimtangker/CVE-2024-46256Repository PoCby kimtangker0Exploit9 files

12.1 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that authenticates to Nginx Proxy Manager 2.11.3 and exploits CVE-2024-46256, a command injection vulnerability in the Let's Encrypt certificate request, to achieve remote code execution by downloading and executing a reverse shell payload.

Backdoor review

No backdoor observed in reviewed code

The PoC script (poc_cve_2024_46256_Tool.py) is a straightforward exploit for CVE-2024-46256. It authenticates to Nginx Proxy Manager, sends a command injection payload via the Let's Encrypt certificate API, and offers version checking, vulnerability verification, and reverse shell execution. All actions are directly related to the claimed vulnerability and are operator-initiated. No concealed, deceptive, or unrelated harmful behavior is present.

ClassificationExploit
Model confidence95%
AuthenticationRequired
Languagespython
Target softwareNginx Proxy Manager
Attack typescommand injectionremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script contains a function execute_rce that constructs a command injection payload and sends it to the vulnerable endpoint, and functions vulncheck and exploit that use this to download and execute a reverse shell, which constitutes exploitation code.

poc_cve_2024_46256_Tool.py:53-69poc_cve_2024_46256_Tool.py:175-202

Requirements

  • Valid credentials for the Nginx Proxy Manager web interface are required to obtain an API token.poc_cve_2024_46256_Tool.py:37-50
  • An attacker-controlled HTTP server must be running to serve a reverse shell payload named 'rev'.poc_cve_2024_46256_Tool.py:175-182

Observed behavior

  • Prompts the user for target URL, credentials, and attacker IP/port, then authenticates to obtain a Bearer token.poc_cve_2024_46256_Tool.py:37-50poc_cve_2024_46256_Tool.py:220-231
  • Sends a crafted JSON payload to /api/nginx/certificates with a domain name containing shell metacharacters to inject an arbitrary command.poc_cve_2024_46256_Tool.py:53-69
  • Downloads a reverse shell binary from the attacker's server to /tmp/rev and makes it executable via injected curl and chmod commands.poc_cve_2024_46256_Tool.py:175-190
  • Executes the downloaded reverse shell payload on the target upon user confirmation.poc_cve_2024_46256_Tool.py:193-202
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Command Injection Payload
Payload withheldThe script constructs a command injection payload in the domain_names field to achieve RCE, consistent with the CVE description.poc_cve_2024_46256_Tool.py:55
Reverse Shell Execution
Payload withheldThe exploit function prompts the operator to start a listener and then executes a pre-staged reverse shell binary, which is standard post-exploitation behavior for an RCE PoC.poc_cve_2024_46256_Tool.py:193-202
Logging
Payload withheldThe script logs actions (login, RCE commands, version check, exit) to a local file, which is a benign operational log and does not exfiltrate data.poc_cve_2024_46256_Tool.py:14-20
Review boundaries

What the analysis did not establish

  • Evidence includes only two text files (README.md and poc_cve_2024_46256_Tool.py) out of nine total files; seven files are omitted and not analyzed.
  • The reverse shell payload 'rev' is not included in the evidence, so its exact behavior cannot be confirmed.
  • Seven files in the repository were omitted from text analysis; their content is unknown.
  • The review is based solely on the supplied text evidence and does not include dynamic analysis or inspection of binary files.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHubTranDongA3/Simulation_CVE-2024-46256Repository PoCby TranDongA30Writeup12 files

1.7 MiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A detailed technical writeup in Vietnamese describing the analysis and exploitation of CVE-2024-46256 and CVE-2024-46257, OS command injection vulnerabilities in Nginx Proxy Manager v2.11.3. The document includes code review, payload examples, and screenshots of a simulated attack, but does not contain executable exploit or scanner code.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and a detailed PoC write-up (POC.md) describing CVE-2024-46256/CVE-2024-46257, which are authenticated OS command injection vulnerabilities in Nginx Proxy Manager. The text documents the vulnerability, provides example payloads (whoami, Python reverse shell), and shows screenshots of exploitation results. No concealed executable behavior, persistence mechanisms, credential theft, or unrelated payloads are present. The artifact is a documentation-only repository with no executable code or instructions that would harm the person reviewing the PoC.

ClassificationWriteup
Model confidence95%
AuthenticationRequired
LanguagesVietnamese
Target softwareNginx Proxy Manager
Attack typesOS Command InjectionRemote Code Execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a detailed technical analysis and simulation narrative. It contains payload examples and describes exploitation steps, but the primary content is explanatory text and screenshots. It does not provide a standalone, executable script to exploit or scan for the vulnerability; it is a writeup.

POC.md:1README.md:1-5

Requirements

  • Attacker must have authenticated access to the Nginx Proxy Manager instance.POC.md:5
  • Target must be running Nginx Proxy Manager version 2.11.3.POC.md:12

Observed behavior

  • The writeup describes injecting a command via the 'certificate.domain_names' parameter to execute 'whoami', with the output 'root' observed in Docker debug logs.POC.md:64POC.md:73-75POC.md:85-87
  • The writeup describes a reverse shell payload using Python, connecting to an ngrok address, and claims successful root access.POC.md:92-94POC.md:96-98
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Payload
Payload withheldExample command injection payload used to demonstrate RCE against the target application (Nginx Proxy Manager), not against the reviewer.POC.md:74
Payload
Payload withheldExample reverse shell payload targeting the vulnerable Nginx Proxy Manager instance, not the reviewer's system.POC.md:93
Review boundaries

What the analysis did not establish

  • The evidence packet contains only the text of POC.md and README.md. Ten non-text media files (screenshots) are present but not analyzed, so the visual evidence of exploitation cannot be verified.
  • The artifact does not include any executable code; the payloads are presented as inline text examples within the writeup.
  • 10 non-text media files (screenshots in static/) were not inspected; they are flagged as metadata-only and could theoretically contain steganographic or malicious content, though the text gives no indication of this.
  • The review is limited to the supplied evidence packets; no external verification of the repository or its history was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHubbarttran2k/POC_CVE-2024-46256Repository PoCby barttran2k6Not analyzed2 files

4.5 KiB

GitHub
PoC details

Docker lab environments

1
GitHub

docker-compose.yml

kimtangker/CVE-2024-46256Created Vuln labCVE-2024-46256Compose · images

1 Compose manifest · 1 service

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment running Nginx Proxy Manager 2.11.3, intended for demonstrating CVE-2024-46256, a remote code execution vulnerability. The environment consists of a single service with exposed HTTP, HTTPS, and admin web interface ports, and bind-mounted data and Let's Encrypt directories.

docker-compose.yml:1-23README.md:1-71

Lab assessment

Vulnerability lab

The README explicitly states the environment is for analyzing CVE-2024-46256, an RCE vulnerability in Nginx Proxy Manager 2.11.3. The Docker Compose file deploys the vulnerable version, and a PoC script is provided to exercise the vulnerability.

README.md:1-3README.md:25-27docker-compose.yml:5
Lab shapeCompose · images
Services1
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

nginx-proxy-manager

vulnerable target service

Runs Nginx Proxy Manager 2.11.3, exposing ports 80, 443, and 81. Uses SQLite database and bind mounts for data and Let's Encrypt certificates. The service is the target for the CVE-2024-46256 RCE exploit.

docker-compose.yml:4-18

poc_cve_2024_46256_Tool.py

exploit scriptvulnerability verification tool

A Python script that logs into the Nginx Proxy Manager web interface, checks the version, verifies vulnerability by attempting command injection via the certificate API, and optionally executes a reverse shell payload. It logs actions to poc_actions.log.

poc_cve_2024_46256_Tool.py:1-258
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2024-46256

Supported by supplied evidence

The README and PoC script both reference CVE-2024-46256 as an RCE in Nginx Proxy Manager 2.11.3. The script implements command injection via the domain_names field in the certificate API, matching the described vulnerability.

README.md:25-27poc_cve_2024_46256_Tool.py:55-68
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to run the environment.README.md:7-9
  • The attacker must have network access to the target Nginx Proxy Manager instance on ports 80, 443, and 81.docker-compose.yml:8-10
  • Valid credentials for the Nginx Proxy Manager admin interface are required (default: admin@example.com / changeme).README.md:17-19
  • For the reverse shell exploit, an attacker-controlled HTTP server serving a 'rev' payload and a netcat listener are needed.poc_cve_2024_46256_Tool.py:155-160

Evidence-described exercise path

  1. Start the vulnerable Nginx Proxy Manager instance using docker-compose up -d.README.md:7-9
  2. Access the admin interface at http://localhost:81 and complete initial setup.README.md:13-15
  3. Run the PoC script (poc_cve_2024_46256_Tool.py) and provide target URL, credentials, and attacker IP/port.poc_cve_2024_46256_Tool.py:200-210
  4. Use the script's menu to perform version check, vulnerability verification (vulncheck), and optional reverse shell execution (exploit).poc_cve_2024_46256_Tool.py:220-240
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The environment is a self-contained vulnerability lab. The PoC script targets only the lab's own Nginx Proxy Manager service. It does not exhibit behavior that escapes the container, compromises the host, or reaches external systems beyond the documented attacker-controlled server used for the reverse shell payload. No hidden persistence, credential theft, or destructive actions are visible.

docker-compose.yml:1-23poc_cve_2024_46256_Tool.py:1-258
Review boundaries

What the analysis did not establish

  • The PoC script references an external attacker-controlled HTTP server and reverse shell listener, which are part of the documented exercise but could be used outside the lab if misconfigured.
  • The script logs actions to a local file (poc_actions.log), which is benign in the lab context but could be considered a local artifact.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

5