1Panel arbitrary file write vulnerability

NGHIÊM TRỌNG 9.8CVE-2023-39966 · GHSA-hf7j-xj3w-87g4 · GO-2023-2006 · Công bố 10/08/2023 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2023-39966 là lỗ hổng mức NGHIÊM TRỌNG (CVSS 9.8) ảnh hưởng github.com/1Panel-dev/1Panel, 1panel (fit2cloud).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.83%, cao hơn 57.7% các lỗ hổng khác.
Cách xử lý: cập nhật lên 1.5.0 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
github.com/1Panel-dev/1Panel Go	`≥ 1.4.3, < 1.5.0`	`1.5.0`
1panel fit2cloud	`= 1.4.3`	Chưa có bản vá

Mô tả

Summary

An arbitrary file write vulnerability could lead to direct control of the server

Details

Arbitrary file creation

In the api/v1/file.go file, there is a function called SaveContentthat,It recieves JSON data sent by users in the form of a POST request. And the lack of parameter filtering allows for arbitrary file write operations.It looks like this:

Vulnerable Code

PoC

We can write the SSH public key into the /etc/.root/authorized_keys configuration file on the server.

The server was successfully written to the public key
Successfully connected to the target server using an SSH private key.

As a result, the server is directly controlled, causing serious harm

Impact

1Panel v1.4.3

Mô tả của NVD

1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, an arbitrary file write vulnerability could lead to direct control of the server. In the `api/v1/file.go` file, there is a function called `SaveContentthat,It `recieves JSON data sent by users in the form of a POST request. And the lack of parameter filtering allows for arbitrary file write operations. Version 1.5.0 contains a patch for this issue.