starred/nginx-proxy-manager-NginxProxyManager

Fork 0

mirror of https://github.com/NginxProxyManager/nginx-proxy-manager.git synced 2026-04-26 18:05:54 +03:00

[GH-ISSUE #515] Shellscript upload possible via upload of 404 pages #437

New issue

Closed

opened 2026-02-26 06:32:51 +03:00 by kerem · 3 comments

kerem commented

2026-02-26 06:32:51 +03:00

Owner

Originally created by @DragonicDefson on GitHub (Jul 20, 2020).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/515

What happened

My NGINX Proxy Manager installation got hacked, They've uploaded a Shellscript to affect the underlying Operating System.

Bug Description

It is possible to upload Shellscript files trough the upload feature and execute them.
All of them with the upload capability.

Behaviour

Depends on the uploaded script.

Operating System

Ubuntu 18.04 LTS

Originally created by @DragonicDefson on GitHub (Jul 20, 2020). Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/515 **What happened** - My NGINX Proxy Manager installation got hacked, They've uploaded a Shellscript to affect the underlying Operating System. **Bug Description** - It is possible to upload Shellscript files trough the upload feature and execute them. - All of them with the upload capability. **Behaviour** - Depends on the uploaded script. **Operating System** - Ubuntu 18.04 LTS

kerem

2026-02-26 06:32:51 +03:00

closed this issue
added the
bug
label

kerem commented

2026-02-26 06:32:51 +03:00

Author

Owner

@netstx commented on GitHub (Aug 1, 2020):

@DragonicDefson do you have any more details on this, like logs or anything else you could share? To me this sounds like a pretty serious bug that we should look into.

@jc21 do you have any feedback on this issue?

@netstx commented on GitHub (Aug 1, 2020): @DragonicDefson do you have any more details on this, like logs or anything else you could share? To me this sounds like a pretty serious bug that we should look into. @jc21 do you have any feedback on this issue?

kerem commented

2026-02-26 06:32:51 +03:00

Author

Owner

@DragonicDefson commented on GitHub (Aug 1, 2020):

@raffieyeah I don't have any more details or logs, because i had root login enabled (no other accounts) so they disabled SSH as well for my IP, had to reset the server which as well took away all logs, but i'm really sure it was a shell script.

An way to protect for this is parsing the inserted code the right way before using it as a 404 page.
If it happens again i will report back to you guys.

also, i'm modifying the proxy manager with custom logo's for my company. i don't know if i'm allowed to do this
but i wanted you guys to know this.

@DragonicDefson commented on GitHub (Aug 1, 2020): @raffieyeah I don't have any more details or logs, because i had root login enabled (no other accounts) so they disabled SSH as well for my IP, had to reset the server which as well took away all logs, but i'm really sure it was a shell script. An way to protect for this is parsing the inserted code the right way before using it as a 404 page. If it happens again i will report back to you guys. also, i'm modifying the proxy manager with custom logo's for my company. i don't know if i'm allowed to do this but i wanted you guys to know this.

kerem commented

2026-02-26 06:32:51 +03:00

Author

Owner

@chaptergy commented on GitHub (May 12, 2021):

The only upload there is, is the certificate upload, and generally everything (even the api) is only available for logged in users. If you could upload 404 pages back then, it seems like this was removed, so this issue is no longer relevant. And if the underlying OS was affected, this sounds like an issue with docker, as it is responsible for the isolation.

@chaptergy commented on GitHub (May 12, 2021): The only upload there is, is the certificate upload, and generally everything (even the api) is only available for logged in users. If you could upload 404 pages back then, it seems like this was removed, so this issue is no longer relevant. And if the underlying OS was affected, this sounds like an issue with docker, as it is responsible for the isolation.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/nginx-proxy-manager-NginxProxyManager#437

No description provided.

Rows
Columns