1panel-dev/1panel · Security
1Panel O&M management panel has a background arbitrary file reading vulnerability
- GHSA ID
- GHSA-pv7q-v9mv-9mh5
- CVE ID
- CVE-2023-39964
- Severity
- high
- Published
- Updated
- CVSS
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS v3
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Description
Summary
Arbitrary file reads allow an attacker to read arbitrary important configuration files on the server.
Details
In the api/v1/file.go file, there is a function called LoadFromFile, which directly reads the file by obtaining the requested path parameter[path]. The request parameters are not filtered, resulting in a background arbitrary file reading vulnerability
PoC
Request /api/v1/files/loadfile, carry /etc/passwd data to read, as shown below:
Impact
1Panel v1.4.3
CWEs
- CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')