Command injection in firewall ip functionality in 1Panel

CVE-2023-37477

Summary

An OS command injection vulnerability exists in the firewall functionality of 1Panel, an open-source Linux server operation and maintenance management panel. An attacker can exploit this vulnerability through specially crafted HTTP requests, allowing for arbitrary command execution on the server. By sending an authenticated HTTP request to the /hosts/firewall/ip endpoint, which fails to validate user input, an attacker has the potential to extend application functionality and execute system commands. This could lead to a complete compromise of the affected system. Users are strongly encouraged to upgrade to version 1.4.3 or later, where this vulnerability has been addressed with the commit e17b80cff49. There are currently no known workarounds.

References