starred/nginx-proxy-manager-NginxProxyManager

Fork 0

mirror of https://github.com/NginxProxyManager/nginx-proxy-manager.git synced 2026-04-25 09:25:55 +03:00

[GH-ISSUE #1950] Stored XSS when deleting proxy host #1415

New issue

Closed

opened 2026-02-26 07:30:53 +03:00 by kerem · 2 comments

kerem commented

2026-02-26 07:30:53 +03:00

Owner

Originally created by @l4rm4nd on GitHub (Mar 24, 2022).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/1950

Steps to reproduce:

Login as administrative user
Create a new proxy host entry with the payload <script>alert('XSS')</script>.google.com as domain
Hit save
Try to delete the newly added proxy host. XSS payload is executed.

Recommendation:

Implementing input validation and/or ensuring output sanitization as done for all other inputs/outputs.

Risk:

Low risk since high privileges are required.

Originally created by @l4rm4nd on GitHub (Mar 24, 2022). Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/1950 **Steps to reproduce:** 1. Login as administrative user 2. Create a new proxy host entry with the payload `<script>alert('XSS')</script>.google.com` as domain 3. Hit save 4. Try to delete the newly added proxy host. XSS payload is executed. ![image](https://user-images.githubusercontent.com/21357789/159934202-5dd026dc-1cd2-4f8d-a54a-63754fed4e58.png) ![image](https://user-images.githubusercontent.com/21357789/159934888-1d864ee7-7906-4ea5-83b8-64a2bc4d69cb.png) ![image](https://user-images.githubusercontent.com/21357789/159934534-a6eef6a2-4bd5-4886-830d-0ab90f63298c.png) **Recommendation:** Implementing input validation and/or ensuring output sanitization as done for all other inputs/outputs. **Risk:** Low risk since high privileges are required.

kerem

2026-02-26 07:30:53 +03:00

closed this issue
added the
bug
label

kerem commented

2026-02-26 07:30:54 +03:00

Author

Owner

@l4rm4nd commented on GitHub (Mar 24, 2022):

Also works for redirection hosts with XSS domain payloads. If a redirection host is deleted, XSS payload is executed.

@l4rm4nd commented on GitHub (Mar 24, 2022): Also works for redirection hosts with XSS domain payloads. If a redirection host is deleted, XSS payload is executed.

kerem commented

2026-02-26 07:30:54 +03:00

Author

Owner

@jc21 commented on GitHub (Mar 24, 2022):

Thanks for the pickup.

Fixed in develop branch and will be out with the next release.

@jc21 commented on GitHub (Mar 24, 2022): Thanks for the pickup. Fixed in `develop` branch and will be out with the next release.

kerem referenced this issue

2026-02-26 08:30:38 +03:00

[PR #1415] [MERGED] Bump nth-check from 1.0.2 to 2.0.1 in /docs #3433

kerem referenced this issue

2026-02-26 08:30:41 +03:00

[PR #1517] [MERGED] v2.9.10 #3447

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/nginx-proxy-manager-NginxProxyManager#1415

No description provided.

Rows
Columns