GHSA-hf7j-xj3w-87g4

Suggest an improvement
Source
https://github.com/advisories/GHSA-hf7j-xj3w-87g4
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/08/GHSA-hf7j-xj3w-87g4/GHSA-hf7j-xj3w-87g4.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-hf7j-xj3w-87g4
Aliases
Published
2023-08-10T20:09:47Z
Modified
2024-08-21T14:41:55.431289Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
1Panel arbitrary file write vulnerability
Details

Summary

An arbitrary file write vulnerability could lead to direct control of the server

Details

Arbitrary file creation

In the api/v1/file.go file, there is a function called SaveContentthat,It recieves JSON data sent by users in the form of a POST request. And the lack of parameter filtering allows for arbitrary file write operations.It looks like this:

  • Vulnerable Code

微信图片_20230801092544

PoC

  • We can write the SSH public key into the /etc/.root/authorized_keys configuration file on the server.

微信图片_20230801093243

  • The server was successfully written to the public key 微信图片_20230801093610

  • Successfully connected to the target server using an SSH private key. 微信图片_20230801093933 微信图片_20230801094037

As a result, the server is directly controlled, causing serious harm

Impact

1Panel v1.4.3

Database specific
{
    "nvd_published_at": "2023-08-10T18:15:11Z",
    "cwe_ids": [
        "CWE-862"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-08-10T20:09:47Z"
}
References

Affected packages

Go / github.com/1Panel-dev/1Panel

Package

Name
github.com/1Panel-dev/1Panel
View open source insights on deps.dev
Purl
pkg:golang/github.com/1Panel-dev/1Panel

Affected ranges

Type
SEMVER
Events
Introduced
1.4.3
Fixed
1.5.0

Affected versions

1.*

1.4.3