Nginx Proxy Manager Misconfiguration Allows Arbitrary Nginx Directive Injection

Executive Summary

Nginx Proxy Manager up to version 2.16.0 allows non-admin users with manage permissions to inject arbitrary nginx directives via the advanced_config field. This bypasses intended restrictions and enables attackers to add malicious nginx configurations like alias directives, which can serve arbitrary files or manipulate routing for assigned hosts.

Useful 0 Not Useful 0

Detection Guidance

Check Nginx Proxy Manager logs for unauthorized changes to advanced_config by non-admin users. Inspect nginx configuration files for unexpected alias directives or malicious nginx directives in host configurations.

Useful 0 Not Useful 0

Impact Analysis

An attacker with manage permissions could exploit this to serve malicious files, redirect traffic, or gain unauthorized access to sensitive data by altering nginx configurations. This could lead to data breaches, service disruption, or further network compromise depending on the injected directives.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of sensitive data, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties, fines, or reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Nginx Proxy Manager to a version that restricts advanced_config to administrators. Review and remove any unauthorized nginx directives in host configurations. Restrict manage permissions to trusted users only.

Useful 0 Not Useful 0