Vulnerability DatabaseCVE-2024-2352

CVE-2024-2352:
vulnerability analysis and mitigation

Overview

A critical command injection vulnerability has been identified in 1Panel versions up to 1.10.1-lts (CVE-2024-2352). The vulnerability affects the function baseApi.UpdateDeviceSwap in the file /api/v1/toolbox/device/update/swap, where manipulation of the Path argument can lead to command injection. The vulnerability was discovered and disclosed on March 8, 2024 (GitHub PR).

Technical details

The vulnerability exists in the UpdateDeviceSwap function where the Path parameter is insufficiently sanitized before being used in command execution. While there is a CheckIllegal function implemented to filter malicious input, it can be bypassed using newline characters (\n). The vulnerability has received a CVSS v3.1 base score of 9.8 CRITICAL (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) (NVD).

Impact

The vulnerability allows remote attackers to execute arbitrary system commands on the affected system. An attacker can bypass the existing WAF protection by using newline characters to inject and execute malicious commands, potentially leading to complete system compromise (GitHub PR).

Exploitability

The vulnerability is exploitable remotely and requires no authentication. A proof of concept exists demonstrating how the WAF can be bypassed using a newline character followed by arbitrary commands (e.g., '123123123\nopen -a Calculator'). The exploit has been publicly disclosed and may be actively used (GitHub PR).

Mitigation and workarounds

A patch has been released to fix this vulnerability. Users should upgrade to version 1.10.2-lts or later. The fix includes additional checks in the CheckIllegal function to properly handle newline characters (\n and \r) (GitHub Patch).