Summary An arbitrary file write vulnerability could lead to direct control of the server Details Arbitrary file creation In the api/v1/file.go file, there is a function called SaveContentthat,It recieves JSON data sent by users in the form of a POST request. And the lack of parameter filtering allows for arbitrary file write operations.It looks like this:

- Vulnerable Code

!微信图片20230801092544

PoC

- We can write the SSH public key into the /etc/.root/authorizedkeys configuration file on the server.

!微信图片20230801093243

- The server was successfully written to the public key !微信图片20230801093610

- Successfully connected to the target server using an SSH private key. !微信图片20230801093933 !微信图片20230801094037

As a result, the server is directly controlled, causing serious harm

Impact 1Panel v1.4.3

Summary Arbitrary file reads allow an attacker to read arbitrary important configuration files on the server.

Details In the api/v1/file.go file, there is a function called LoadFromFile, which directly reads the file by obtaining the requested path parameter[path]. The request parameters are not filtered, resulting in a background arbitrary file reading vulnerability !picture1

PoC Request /api/v1/files/loadfile, carry /etc/passwd data to read, as shown below: !微信图片20230731112833

Impact 1Panel v1.4.3

Summary Any file downloading vulnerability exists in 1Panel backend.

Details Authenticated attackers can download arbitrary files through the API interface. This code has unauthorized access. !image

PoC payload:

POST /api/v1/files/download/bypath HTTP/1.1 Host: ip Content-Type: application/json

{"path":"/etc/passwd"}

!f77959349e96543436eea18283fa75c

Impact Attackers can freely download the file content on the target system. This will be caused a large amount of information leakage.