CVE-2024-39907: 1Panel has an SQL injection issue related to the orderBy clause
Summary There are many sql injections in the project, and some of them are not well filtered, leading to arbitrary file writes, and ultimately leading to RCEs. The proof is as follows Details （one of them ） PoC curl 'http://api:30455/api/v1/hosts/command/search' {"page":1,"pageSize":10,"groupID":0,"orderBy":"3","order":"ascending","name":"a"} for example as picture .
Published Jul 18, 2024 · Updated Aug 3, 2024
Affected packages
github.com/1Panel-dev/1Panel
- Ecosystem
- Go
- Affected
- < 1.10.12-tls
- Fixed in
- 1.10.12-tls
- Check
go list -m github.com/1Panel-dev/1Panel
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Summary
There are many sql injections in the project, and some of them are not well filtered, leading to arbitrary file writes, and ultimately leading to RCEs. The proof is as follows
Details （one of them ）
PoC
curl 'http://api:30455/api/v1/hosts/command/search' {"page":1,"pageSize":10,"groupID":0,"orderBy":"3","order":"ascending","name":"a"}
for example as picture . just change orderby‘s num we can know How many columns does the data table have.Parameters require strict whitelist filtering
Impact
RCE、data leak.
Credited to xuebibibibibi.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology