1Panel up to 1.4.2 HTTP Request /hosts/firewall/ip os command injection

Summaryinfo

A vulnerability was found in 1Panel up to 1.4.2. It has been declared as critical. The impacted element is an unknown function of the file /hosts/firewall/ip of the component HTTP Request Handler. The manipulation results in os command injection. This vulnerability is known as CVE-2023-37477. It is possible to launch the attack remotely. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in 1Panel up to 1.4.2. Affected is some unknown processing of the file /hosts/firewall/ip of the component HTTP Request Handler. The manipulation with an unknown input leads to a os command injection vulnerability. CWE is classifying the issue as CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

1Panel is an open source Linux server operation and maintenance management panel. An OS command injection vulnerability exists in 1Panel firewall functionality. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability. 1Panel firewall functionality `/hosts/firewall/ip` endpoint read user input without validation, the attacker extends the default functionality of the application, which execute system commands. An attacker can execute arbitrary code on the target system, which can lead to a complete compromise of the system. This issue has been addressed in commit `e17b80cff49` which is included in release version `1.4.3`. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The weakness was published 07/18/2023 as GHSA-p9xf-74xh-mhw5. The advisory is available at github.com. This vulnerability is traded as CVE-2023-37477 since 07/06/2023. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1202 by the MITRE ATT&CK project.

Upgrading to version 1.4.3 eliminates this vulnerability. Applying the patch e17b80cff4975ee343568ff526b62319f499005d is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• 1Panel

Version

• 1.4.0
• 1.4.1
• 1.4.2

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion