1Panel arbitrary file write vulnerability exists in the background

CVE-2023-39966

Summary

1Panel, an open-source Linux server management tool, has been identified with a vulnerability in version 1.4.3 that allows for arbitrary file write operations. This issue arises from an inadequate filtering mechanism in the SaveContent function located in the api/v1/file.go file, which processes JSON data received via POST requests. Attackers could exploit this flaw to manipulate files on the server, potentially leading to unauthorized access and control. The vulnerability has been addressed in version 1.5.0, which implements necessary security measures to prevent such exploits.

References