GitHub Advisoryadvisory · Go

GHSA-85cf-gj29-f555 1Panel Arbitrary File Download vulnerability

MEDIUM Published 2023-08-10 Modified 2023-08-10 Official page ↗
Aliases
CVE-2023-39965
Ecosystem
Go
Packages
github.com/1Panel-dev/1Panel
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Weaknesses
CWE-863
Reviewed
2023-08-10

Affected packages

• Go github.com/1Panel-dev/1Panel: >= 1.4.3, < 1.5.0 → fixed in 1.5.0

Description

Summary Any file downloading vulnerability exists in 1Panel backend. Details Authenticated attackers can download arbitrary files through the API interface. This code has unauthorized access. PoC payload: POST /api/v1/files/download/bypath HTTP/1.1 Host: ip Content-Type: application/json {"path":"/etc/passwd"} Impact Attackers can freely download the file content on the target system. This will be caused a large amount of information leakage.

Related

Alias · CVE (1)

  • CVE-2023-39965 1Panel is an open source Linux server operation and maintenance management panel. vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References