Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS1wdjdxLXY5bXYtOW1oNc4AA1OD

1Panel O&M management panel has a background arbitrary file reading vulnerability

Summary

Arbitrary file reads allow an attacker to read arbitrary important configuration files on the server.

Details

In the api/v1/file.go file, there is a function called LoadFromFile, which directly reads the file by obtaining the requested path parameter[path]. The request parameters are not filtered, resulting in a background arbitrary file reading vulnerability
picture1

PoC

Request /api/v1/files/loadfile, carry /etc/passwd data to read, as shown below:
微信图片_20230731112833

Impact

1Panel v1.4.3

Permalink: https://github.com/advisories/GHSA-pv7q-v9mv-9mh5
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wdjdxLXY5bXYtOW1oNc4AA1OD
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 1 year ago
Updated: about 1 year ago


CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Percentage: 0.00155
EPSS Percentile: 0.52509

Identifiers: GHSA-pv7q-v9mv-9mh5, CVE-2023-39964
References: Repository: https://github.com/1Panel-dev/1Panel
Blast Radius: 1.0

Affected Packages

go:github.com/1Panel-dev/1Panel
Dependent packages: 1
Dependent repositories: 0
Downloads:
Affected Version Ranges: = 1.4.3
Fixed in: 1.5.0
All affected versions:
All unaffected versions: 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.3.0, 1.3.1, 1.3.2, 1.3.3, 1.3.4, 1.3.5, 1.3.6, 1.4.0, 1.4.1, 1.4.2, 1.4.3, 1.5.0, 1.5.1, 1.5.2, 1.5.3, 1.5.4, 1.5.5, 1.6.0, 1.6.1, 1.6.2, 1.7.0, 1.7.1, 1.7.2, 1.7.3, 1.7.4, 1.8.0, 1.8.1, 1.8.2, 1.8.3, 1.8.4, 1.8.5, 1.9.0, 1.9.1, 1.9.2, 1.9.3, 1.9.4, 1.9.5, 1.9.6