{"id":"GHSA-hf7j-xj3w-87g4","summary":"1Panel arbitrary file write vulnerability","details":"# Summary\nAn arbitrary file write vulnerability could lead to direct control of the server\n# Details\n## Arbitrary file creation\nIn the api/v1/file.go file, there is a function called SaveContentthat,It recieves JSON data sent by users in the form of a POST request. And the lack of parameter filtering allows for arbitrary file write operations.It looks like this:\n\n- Vulnerable Code\n\n![微信图片_20230801092544](https://user-images.githubusercontent.com/136411443/257381095-4d7c014b-b699-4152-8b9d-2cc9399dfd85.png)\n\n# PoC\n\n- We can write the SSH public key into the /etc/.root/authorized_keys configuration file on the server.\n\n![微信图片_20230801093243](https://user-images.githubusercontent.com/136411443/257381907-38784fab-77b9-47b9-a598-44ef7ad0b65c.png)\n\n- The server was successfully written to the public key\n![微信图片_20230801093610](https://user-images.githubusercontent.com/136411443/257382468-b4836eee-f751-4b43-93ff-cb39fdc6c809.png)\n\n- Successfully connected to the target server using an SSH private key.\n![微信图片_20230801093933](https://user-images.githubusercontent.com/136411443/257383031-53f1e5de-2743-48ed-a1cf-9a5ea0c0f90b.png)\n![微信图片_20230801094037](https://user-images.githubusercontent.com/136411443/257383041-d9f64647-95d9-4711-8b9f-e152966537c9.png)\n\nAs a result, the server is directly controlled, causing serious **harm**\n\n\n# Impact\n1Panel v1.4.3\n","aliases":["CVE-2023-39966","GO-2023-2006"],"modified":"2024-08-21T14:42:30.999882Z","published":"2023-08-10T20:09:47Z","database_specific":{"github_reviewed_at":"2023-08-10T20:09:47Z","nvd_published_at":"2023-08-10T18:15:11Z","cwe_ids":["CWE-862"],"severity":"HIGH","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-hf7j-xj3w-87g4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39966"},{"type":"PACKAGE","url":"https://github.com/1Panel-dev/1Panel"},{"type":"WEB","url":"https://github.com/1Panel-dev/1Panel/releases/tag/v1.5.0"}],"affected":[{"package":{"name":"github.com/1Panel-dev/1Panel","ecosystem":"Go","purl":"pkg:golang/github.com/1Panel-dev/1Panel"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.4.3"},{"fixed":"1.5.0"}]}],"versions":["1.4.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/08/GHSA-hf7j-xj3w-87g4/GHSA-hf7j-xj3w-87g4.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}]}