1Panel arbitrary file write vulnerability

緊急 9.8CVE-2023-39966 · GHSA-hf7j-xj3w-87g4 · GO-2023-2006 · 10/08/2023 公開 · 17/06/2026 更新

要点

CVE-2023-39966 は github.com/1Panel-dev/1Panel, 1panel (fit2cloud) に影響する深刻度「緊急」 (CVSS 9.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.83%（全脆弱性の 57.7% より高い）。
対処：1.5.0 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
github.com/1Panel-dev/1Panel Go	`≥ 1.4.3, < 1.5.0`	`1.5.0`
1panel fit2cloud	`= 1.4.3`	修正版なし

概要

Summary

An arbitrary file write vulnerability could lead to direct control of the server

Details

Arbitrary file creation

In the api/v1/file.go file, there is a function called SaveContentthat,It recieves JSON data sent by users in the form of a POST request. And the lack of parameter filtering allows for arbitrary file write operations.It looks like this:

Vulnerable Code

PoC

We can write the SSH public key into the /etc/.root/authorized_keys configuration file on the server.

The server was successfully written to the public key
Successfully connected to the target server using an SSH private key.

As a result, the server is directly controlled, causing serious harm

Impact

1Panel v1.4.3

NVD の説明

1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, an arbitrary file write vulnerability could lead to direct control of the server. In the `api/v1/file.go` file, there is a function called `SaveContentthat,It `recieves JSON data sent by users in the form of a POST request. And the lack of parameter filtering allows for arbitrary file write operations. Version 1.5.0 contains a patch for this issue.