CVE-2024-30257: 1Panel's password verification is suspected to have a timing attack vulnerability
Summary 源码中密码校验处使用 != 符号，而不是hmac.Equal，这可能导致产生计时攻击漏洞，从而爆破密码。 建议使用 hmac.Equal 比对密码。
Translation:
The source code uses the != symbol instead of hmac.Equal for password verification, which may lead to timing attack vulnerabilities that can lead to password cracking. It is recommended to use hmac. Equal to compare passwords.
Details https://github.com/1Panel-dev/1Panel/blob/dev/backend/app/service/auth.go#L81C5-L81C26
Impact 该产品的所有使用者。
Translation:
All users of this product.
Other sources
1Panel is an open source Linux server operation and maintenance management panel. The password verification in the source code uses the != symbol instead hmac.Equal. This may lead to a timing attack vulnerability. This vulnerability is fixed in 1.10.3-lts.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-30257?
CVE-2024-30257 is classified as a medium severity vulnerability due to the risk of timing attacks affecting password security.
How do I fix CVE-2024-30257?
To fix CVE-2024-30257, modify the password comparison to use `hmac.Equal` instead of the `!=` symbol.
Who is affected by CVE-2024-30257?
All users of versions up to and including 1.10.3 of the 1Panel software are affected by CVE-2024-30257.
What type of attack does CVE-2024-30257 enable?
CVE-2024-30257 enables timing attacks that can facilitate password brute-forcing.
Which software versions are vulnerable to CVE-2024-30257?
The vulnerable versions of the software are all versions prior to 1.10.3 of the 1Panel package.