github.com
https://github.com/1Panel-dev/1Panel CVE-2024-34352
MEDIUM
Arbitrary file write vulnerability in 1Panel
Record summary
CVE-2024-34352 has a selected CVSS score of 6.5 (medium).
Description
1Panel is an open source Linux server operation and maintenance management panel. Prior to v1.10.3-lts, there are many command injections in the project, and some of them are not well filtered, leading to arbitrary file writes, and ultimately leading to RCEs. The mirror configuration write symbol `>` can be used to achieve arbitrary file writing. This vulnerability is fixed in v1.10.3-lts.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationPoC
AutomatableNo
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated May 9, 2024 · Source: CVE List
Affected products and versions
3| Product | Source | Version range | Status |
|---|---|---|---|
| CVE List | <= v1.10.2-lts | affected | |
Default status: unknown | CVE List | Before 1.10.3-lts | affected |
github.com/1Panel-dev/1PanelBrowse Go / github.com/1Panel-dev/1Panel | GitHub Advisory | Before 1.10.3-lts · Fixed in 1.10.3-lts | affected |
References
5github.com
https://github.com/1Panel-dev/1Panel/commit/e037b69f52799e110af8e98f39a3627ad0285ea6 github.comConfirmation
https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-f8ch-w75v-c847 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2024-34352 pkg.go.dev
https://pkg.go.dev/vuln/GO-2024-2830