What is CVE-2023-39966?

CVE-2023-39966 is an arbitrary file write vulnerability in 1Panel version 1.4.3 that could lead to direct control of the server.

How severe is CVE-2023-39966?

CVE-2023-39966 has a severity score of 9.8 (critical).

How does CVE-2023-39966 work?

CVE-2023-39966 allows an attacker to create arbitrary files on the server by sending JSON data in a POST request, potentially leading to full control of the server.

What software versions are affected by CVE-2023-39966?

1Panel version 1.4.3 is affected by CVE-2023-39966.

How do I fix CVE-2023-39966?

To fix CVE-2023-39966, update to version 1.5.0 of 1Panel.

Vulnerability/
CVE-2023-39966

critical

9.8

CWE

862

10/8/2023

4/10/2024

CVE-2023-39966: 1Panel arbitrary file write vulnerability exists in the background

First published: Thu Aug 10 2023(Updated: )

# Summary An arbitrary file write vulnerability could lead to direct control of the server # Details ## Arbitrary file creation In the api/v1/file.go file, there is a function called SaveContentthat,It recieves JSON data sent by users in the form of a POST request. And the lack of parameter filtering allows for arbitrary file write operations.It looks like this: - Vulnerable Code ![微信图片_20230801092544](https://user-images.githubusercontent.com/136411443/257381095-4d7c014b-b699-4152-8b9d-2cc9399dfd85.png) # PoC - We can write the SSH public key into the /etc/.root/authorized_keys configuration file on the server. ![微信图片_20230801093243](https://user-images.githubusercontent.com/136411443/257381907-38784fab-77b9-47b9-a598-44ef7ad0b65c.png) - The server was successfully written to the public key ![微信图片_20230801093610](https://user-images.githubusercontent.com/136411443/257382468-b4836eee-f751-4b43-93ff-cb39fdc6c809.png) - Successfully connected to the target server using an SSH private key. ![微信图片_20230801093933](https://user-images.githubusercontent.com/136411443/257383031-53f1e5de-2743-48ed-a1cf-9a5ea0c0f90b.png) ![微信图片_20230801094037](https://user-images.githubusercontent.com/136411443/257383041-d9f64647-95d9-4711-8b9f-e152966537c9.png) As a result, the server is directly controlled, causing serious **harm** # Impact 1Panel v1.4.3

Credit: security-advisories@github.com security-advisories@github.com security-advisories@github.com

Affected Software	Affected Version	How to fix
Fit2cloud 1panel	=1.4.3

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is CVE-2023-39966?
CVE-2023-39966 is an arbitrary file write vulnerability in 1Panel version 1.4.3 that could lead to direct control of the server.
How severe is CVE-2023-39966?
CVE-2023-39966 has a severity score of 9.8 (critical).
How does CVE-2023-39966 work?
CVE-2023-39966 allows an attacker to create arbitrary files on the server by sending JSON data in a POST request, potentially leading to full control of the server.
What software versions are affected by CVE-2023-39966?
1Panel version 1.4.3 is affected by CVE-2023-39966.
How do I fix CVE-2023-39966?
To fix CVE-2023-39966, update to version 1.5.0 of 1Panel.

collector/nvd-index
collector/nvd-cve
collector/github-advisory-latest
alias/GHSA-hf7j-xj3w-87g4
alias/CVE-2023-39966
collector/github-advisory
agent/type
agent/references
agent/softwarecombine
agent/weakness
agent/title
agent/severity
agent/author
agent/description
agent/first-publish-date
agent/event
collector/mitre-cve
source/MITRE
agent/last-modified-date
agent/trending
agent/source
agent/tags
collector/nvd-api
agent/software-canonical-lookup-request
vendor/fit2cloud
canonical/fit2cloud 1panel
version/fit2cloud 1panel/1.4.3
package-manager/go