PT-2024-19921 · 1Panel · 1Panel

Linyz-Tel · Published 2024-03-09 · Updated 2024-06-04 · CVE-2024-2352

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions 1Panel versions up to 1.10.1-lts

Description A critical issue has been found in the function baseApi.UpdateDeviceSwap of the file /api/v1/toolbox/device/update/swap. The manipulation of the argument Path with a specific input leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Recommendations To fix this issue, apply a patch to the affected version of 1Panel. As a temporary workaround, consider restricting access to the /api/v1/toolbox/device/update/swap endpoint until a patch is available. Avoid using the Path argument in the affected API endpoint until the issue is resolved.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2024-2352

GHSA-X2VG-5WRF-VJ6V

GO-2024-2636

Affected Products

1Panel

References · 13

• 🔥 https://github.com/1Panel-dev/1Panel/pull/4131 · Exploit
• 🔥 https://github.com/1Panel-dev/1Panel/pull/4131#issue-2176105990 · Exploit
• https://github.com/1Panel-dev/1Panel/pull/4131/commits/0edd7a9f6f5100aab98a0ea6e5deedff7700396c · Patch
• https://osv.dev/vulnerability/CVE-2024-2352 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-2352 · Security Note
• https://osv.dev/vulnerability/GHSA-x2vg-5wrf-vj6v · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2636 · Vendor Advisory
• https://github.com/1Panel-dev/1Panel · Note
• https://t.me/cvenotify/73441 · Telegram Post
• https://twitter.com/CVEnew/status/1766645985176846397 · Twitter Post
• https://github.com/advisories/GHSA-x2vg-5wrf-vj6v · Note
• https://vuldb.com/?id.256304 · Note
• https://vuldb.com/?ctiid.256304 · Note