CVE-2024-46256

Deeper analysis

CVE-2024-46256 is a command injection vulnerability in NginxProxyManager version 2.11.3 that resides in the requestLetsEncryptSsl function within the backend certificate handling code. The flaw, tracked under CWE-77, permits remote code execution when an attacker triggers the Add Let's Encrypt Certificate workflow, and it carries a CVSS 3.1 score of 9.8 reflecting network-accessible, unauthenticated exploitation with full confidentiality, integrity, and availability impact.

An unauthenticated attacker with network access to the management interface can supply crafted input during certificate provisioning to execute arbitrary commands on the host. Successful exploitation grants the attacker full remote code execution, enabling complete system compromise without requiring credentials or user interaction.

Public references include the vulnerable code path at backend/internal/certificate.js line 830, a corrective commit, and an associated pull request that address the injection issue, indicating that upgrading to a patched release is the intended mitigation.

A publicly available proof-of-concept exploit exists, and the CVE's EPSS score has reached a peak of 0.6860 with a current value of 0.6015, demonstrating sustained exploitation interest following disclosure.