CVE-2024-39935 – CVE-2024-39935 is an OS command injection vulne... (How to Fix)

Q: What is the severity of CVE-2024-39935?

CVE-2024-39935 has a CVSS score of 8.8 (HIGH). CVE-2024-39935 is an OS command injection vulnerability in jc21 NGINX Proxy Manager that allows authenticated users with certificate management privileges to execute arbitrary commands on the host system via DNS provider configuration input. This affects versions before 2.11.3 and requires the attacker to have valid credentials with specific administrative permissions.

📋 TL;DR

CVE-2024-39935 is an OS command injection vulnerability in jc21 NGINX Proxy Manager that allows authenticated users with certificate management privileges to execute arbitrary commands on the host system via DNS provider configuration input. This affects versions before 2.11.3 and requires the attacker to have valid credentials with specific administrative permissions.

💻 Affected Systems

Products:

jc21 NGINX Proxy Manager

Versions: All versions before 2.11.3

Operating Systems: All platforms running NGINX Proxy Manager

Default Config Vulnerable: ⚠️ Yes

Notes: Requires authenticated user with certificate management privileges. Not related to official F5 NGINX software.

📦 What is this software?

Nginx Proxy Manager by Jc21

View all CVEs affecting Nginx Proxy Manager →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Full system compromise allowing attacker to execute arbitrary commands with the privileges of the NGINX Proxy Manager process, potentially leading to data theft, lateral movement, or complete host takeover.

🟠

Likely Case

Authenticated attackers with certificate management access can execute commands to steal sensitive data, modify configurations, or deploy malware on the affected system.

🟢

If Mitigated

With proper access controls limiting certificate management privileges to trusted administrators only, impact is reduced to potential insider threat scenarios.

🌐 Internet-Facing: HIGH if the management interface is exposed to the internet, as authenticated attackers could exploit this remotely.

🏢 Internal Only: MEDIUM as it requires authenticated access with specific privileges, but could be exploited by compromised accounts or malicious insiders.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires authenticated access with certificate management privileges. The vulnerability is in backend/internal/certificate.js where untrusted input is passed to OS commands.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.11.3

Vendor Advisory: https://github.com/NginxProxyManager/nginx-proxy-manager/commit/99cce7e2b0da2978411cedd7cac5fffbe15bc46

Restart Required: Yes

Instructions:

1. Backup current configuration. 2. Update to version 2.11.3 or later using your deployment method (Docker, manual install, etc.). 3. Restart the NGINX Proxy Manager service. 4. Verify the update was successful.

🔧 Temporary Workarounds

Restrict Certificate Management Access

all

Limit certificate management privileges to only essential administrators to reduce attack surface.

Network Segmentation

all

Isolate NGINX Proxy Manager management interface from untrusted networks.

🧯 If You Can't Patch

Implement strict access controls to limit certificate management privileges to minimal trusted personnel only.
Monitor and audit all certificate management activities and command execution logs for suspicious patterns.

🔍 How to Verify

Check if Vulnerable:

Check the NGINX Proxy Manager version in the web interface or by examining the container/image version. If version is below 2.11.3, the system is vulnerable.

Check Version:

docker exec nginx-proxy-manager cat /app/package.json | grep version

Verify Fix Applied:

Confirm version is 2.11.3 or higher in the web interface or via version check command. Test certificate management functionality to ensure it works without allowing command injection.

📡 Detection & Monitoring

Log Indicators:

Unusual certificate management activities
Suspicious command execution patterns in system logs
Multiple failed authentication attempts followed by certificate management actions

Network Indicators:

Unexpected outbound connections from NGINX Proxy Manager host
Unusual DNS queries from the management interface

SIEM Query:

source="nginx-proxy-manager" AND (event_type="certificate_management" OR command_execution) AND user NOT IN ["trusted_admin_list"]

📊 Metadata

CVE ID: CVE-2024-39935

CVSS v3 Score: 8.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-78

Published: July 4, 2024

Last Updated: October 2, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-39935, you might also want to check these: