PT-2023-27177 · 1Panel · 1Panel

Qiulongk · Published 2023-08-10 · Updated 2024-08-21 · CVE-2023-39965

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions 1Panel versions 1.4.3

Description 1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, authenticated attackers can download arbitrary files through the API interface, specifically the "POST /api/v1/files/download/bypath" endpoint, by providing a path variable, such as {"path":"/etc/passwd"}, allowing unauthorized access to the target system's files. This may cause a large amount of information leakage.

Recommendations For version 1.4.3, update to version 1.5.0 to resolve the issue. As a temporary workaround, consider restricting access to the /api/v1/files/download/bypath endpoint until the patch is applied. Avoid using the path variable in the affected API endpoint until the issue is resolved.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2023-39965

GHSA-85CF-GJ29-F555

GO-2023-2005

Affected Products

1Panel

References · 10

• 🔥 https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-85cf-gj29-f555 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39965.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-39965 · Security Note
• https://osv.dev/vulnerability/GO-2023-2005 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-85cf-gj29-f555 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-39965 · Vendor Advisory
• https://github.com/1Panel-dev/1Panel/releases/tag/v1.5.0 · Note
• https://github.com/1Panel-dev/1Panel · Note
• https://twitter.com/VulmonFeeds/status/1689740418110406658 · Twitter Post
• https://t.me/cvenotify/56644 · Telegram Post