PT-2023-3483 · 1Panel · 1Panel

Wanghe-Fit2Cloud · Published 2023-06-21 · Updated 2024-08-20 · CVE-2023-36458

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions 1Panel versions prior to 1.3.6

Description The issue is related to command injection when entering the container terminal in 1Panel, an open source Linux server operation and maintenance management panel. An authenticated attacker can craft malicious payloads to achieve this. The vulnerability allows a remote attacker to execute arbitrary commands.

Recommendations For versions prior to 1.3.6, upgrade to version 1.3.6 to fix the vulnerability. As a temporary workaround, consider restricting access to the container terminal until the upgrade is applied.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2023-03678

CVE-2023-36458

GHSA-7X2C-FGX6-XF9H

GO-2023-1888

Affected Products

1Panel

References · 12

• 🔥 https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-7x2c-fgx6-xf9h · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36458.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-36458 · Security Note
• https://osv.dev/vulnerability/CVE-2023-36458 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7x2c-fgx6-xf9h · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-03678 · Security Note
• https://osv.dev/vulnerability/GO-2023-1888 · Vendor Advisory
• https://github.com/1Panel-dev/1Panel · Note
• https://github.com/1Panel-dev/1Panel/blob/dev/README_EN.md · Note
• https://github.com/1Panel-dev/1Panel/releases/tag/v1.3.6 · Note
• https://vuldb.com/ru/?id.233027 · Note
• https://t.me/cibsecurity/66016 · Telegram Post