Command injection in firewall ip functionality in 1Panel
CVE-2023-37477

7.2HIGH

Key Information:

Vendor

1panel-dev

Status
1panel
Vendor
CVE Published:
18 July 2023

What is CVE-2023-37477?

An OS command injection vulnerability exists in the firewall functionality of 1Panel, an open-source Linux server operation and maintenance management panel. An attacker can exploit this vulnerability through specially crafted HTTP requests, allowing for arbitrary command execution on the server. By sending an authenticated HTTP request to the /hosts/firewall/ip endpoint, which fails to validate user input, an attacker has the potential to extend application functionality and execute system commands. This could lead to a complete compromise of the affected system. Users are strongly encouraged to upgrade to version 1.4.3 or later, where this vulnerability has been addressed with the commit e17b80cff49. There are currently no known workarounds.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

1Panel < 1.4.3

References

https://github.com/1Panel-dev/1Panel/security/advisories/...
x_refsource_CONFIRM
https://github.com/1Panel-dev/1Panel/commit/e17b80cff4975...
x_refsource_MISC

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.