// For flags

CVE-2024-34352

Arbitrary file write vulnerability in 1Panel

Severity Score

6.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Attend
*SSVC
Descriptions

1Panel is an open source Linux server operation and maintenance management panel. Prior to v1.10.3-lts, there are many command injections in the project, and some of them are not well filtered, leading to arbitrary file writes, and ultimately leading to RCEs. The mirror configuration write symbol `>` can be used to achieve arbitrary file writing. This vulnerability is fixed in v1.10.3-lts.

1Panel es un panel de gestión de operación y mantenimiento de servidores Linux de código abierto. Antes de v1.10.3-lts, había muchas inyecciones de comandos en el proyecto y algunas de ellas no estaban bien filtradas, lo que provocaba escrituras de archivos arbitrarias y, en última instancia, RCE. El símbolo de escritura de configuración espejo `>` se puede utilizar para lograr la escritura de archivos arbitraria. Esta vulnerabilidad se solucionó en v1.10.3-lts.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Attend
Exploitation
Poc
Automatable
No
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2024-05-02 CVE Reserved
  • 2024-05-09 CVE Published
  • 2024-05-10 EPSS Updated
  • 2024-08-02 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
CAPEC
References (1)
URL Tag Source
https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-f8ch-w75v-c847 X_refsource_confirm
URL Date SRC
URL Date SRC
URL Date SRC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
1Panel-dev
Search vendor "1Panel-dev"
 1Panel
Search vendor "1Panel-dev" for product "1Panel"
 <= 1.10.2
Search vendor "1Panel-dev" for product "1Panel" and version " <= 1.10.2"
en
Affected