CVE-2023-39966: 1Panel arbitrary file write vulnerability exists in the background
Summary An arbitrary file write vulnerability could lead to direct control of the server Details Arbitrary file creation In the api/v1/file.go file, there is a function called SaveContentthat,It recieves JSON data sent by users in the form of a POST request. And the lack of parameter filtering allows for arbitrary file write operations.It looks like this:
- Vulnerable Code
!微信图片20230801092544
PoC
- We can write the SSH public key into the /etc/.root/authorizedkeys configuration file on the server.
!微信图片20230801093243
- The server was successfully written to the public key !微信图片20230801093610
- Successfully connected to the target server using an SSH private key. !微信图片20230801093933 !微信图片20230801094037
As a result, the server is directly controlled, causing serious harm
Impact 1Panel v1.4.3
Other sources
1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, an arbitrary file write vulnerability could lead to direct control of the server. In the api/v1/file.go file, there is a function called SaveContentthat,It recieves JSON data sent by users in the form of a POST request. And the lack of parameter filtering allows for arbitrary file write operations. Version 1.5.0 contains a patch for this issue.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-39966?
CVE-2023-39966 is an arbitrary file write vulnerability in 1Panel version 1.4.3 that could lead to direct control of the server.
How severe is CVE-2023-39966?
CVE-2023-39966 has a severity score of 9.8 (critical).
How does CVE-2023-39966 work?
CVE-2023-39966 allows an attacker to create arbitrary files on the server by sending JSON data in a POST request, potentially leading to full control of the server.
What software versions are affected by CVE-2023-39966?
1Panel version 1.4.3 is affected by CVE-2023-39966.
How do I fix CVE-2023-39966?
To fix CVE-2023-39966, update to version 1.5.0 of 1Panel.