CVE-2024-2352: 1Panel swap baseApi.UpdateDeviceSwap command injection
First published: Sun Mar 10 2024(Updated: )
1Panel is vulnerable to command injection. This vulnerability has been classified as critical, has been found in 1Panel up to 1.10.1-lts. Affected by this issue is the function baseApi.UpdateDeviceSwap of the file /api/v1/toolbox/device/update/swap. The manipulation of the argument Path with the input 123123123\nopen -a Calculator leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-256304.
Credit: cna@vuldb.com cna@vuldb.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| go/github.com/1Panel-dev/1Panel | <1.10.1-lts | 1.10.1-lts |
| Fit2cloud 1panel | <1.10.2-lts |
Remedy
https://github.com/1Panel-dev/1Panel/pull/4131/commits/0edd7a9f6f5100aab98a0ea6e5deedff7700396c
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://vuldb.com/?id.256304
- https://vuldb.com/?ctiid.256304
- https://github.com/1Panel-dev/1Panel/pull/4131
- https://github.com/1Panel-dev/1Panel/pull/4131#issue-2176105990
- https://github.com/1Panel-dev/1Panel/pull/4131/commits/0edd7a9f6f5100aab98a0ea6e5deedff7700396c
- https://nvd.nist.gov/vuln/detail/CVE-2024-2352
- https://github.com/advisories/GHSA-x2vg-5wrf-vj6v (Advisory)
Frequently Asked Questions
What is the severity of CVE-2024-2352?
CVE-2024-2352 is classified as a critical vulnerability.
How do I fix CVE-2024-2352?
To fix CVE-2024-2352, upgrade to 1Panel version 1.10.2-lts or later.
What software versions are affected by CVE-2024-2352?
CVE-2024-2352 affects 1Panel versions up to 1.10.1-lts.
What type of vulnerability is CVE-2024-2352?
CVE-2024-2352 is a command injection vulnerability.
Which specific function in 1Panel is vulnerable according to CVE-2024-2352?
The function baseApi.UpdateDeviceSwap in the file /api/v1/toolbox/device/update/swap is vulnerable.
- agent/title
- agent/weakness
- agent/first-publish-date
- agent/type
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-x2vg-5wrf-vj6v
- alias/CVE-2024-2352
- agent/software-canonical-lookup
- agent/references
- agent/description
- collector/nvd-cve
- source/NVD
- agent/author
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/trending
- agent/source
- collector/nvd-api
- agent/severity
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- agent/event
- agent/tags
- package-manager/go
- vendor/fit2cloud
- canonical/fit2cloud 1panel