CVE-2024-46256 PoC — NginxProxyManager 安全漏洞

Source

https://github.com/TranDongA3/Simulation_CVE-2024-46256

Associated Vulnerability

Title: NginxProxyManager 安全漏洞 (CVE-2024-46256)
Description:A Command injection vulnerability in requestLetsEncryptSsl in NginxProxyManager 2.11.3 allows an attacker to RCE via Add Let's Encrypt Certificate.

Readme

# CVE-2024-46256 & CVE-2024-46257 – PoC Simulation

## Overview

This repository contains a step-by-step, image-backed Proof of Concept (PoC) simulating two vulnerabilities in Nginx Proxy Manager that enable OS Command Injection, leading to Remote Code Execution (RCE) after authentication.

- Affected product: Nginx Proxy Manager
- Affected version: v2.11.3
- Impact: Authenticated RCE (observed with root privileges in PoC)

## Contents

- `POC.md`: Detailed write-up of the analysis and exploitation steps, including payloads and observations.
- `static/`: Screenshots referenced by `POC.md` in the order they appear.

## How to Use

1. Open `POC.md` to follow the simulation narrative.
2. Each section references images from `static/` to illustrate setup, code review, exploitation, and results.

## Notes and Disclaimer

- The PoC is for educational and defensive security research only.
- Do not use against systems you do not own or have explicit permission to test.
- Always update to patched versions and apply least-privilege principles.

## References

- Nginx Proxy Manager repository: https://github.com/NginxProxyManager/nginx-proxy-manager
- CVE-2024-46256
- CVE-2024-46257

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →