CVE-2025-54424: 
vulnerability analysis and mitigation

CVE-2025-54424 is a certificate verification bypass vulnerability in 1Panel (a Linux server management web interface and MCP Server) that allows unauthenticated remote attackers to access privileged Agent endpoints and achieve Remote Code Execution (RCE). It affects all versions of 1Panel from 1.0.0 through 2.0.5 (inclusive), and was disclosed on August 1, 2025 by researcher lizicoco via the GitHub Security Advisory GHSA-8j63-96wh-wh3j. The vulnerability was patched in version 2.0.6, released July 30, 2025. The CVSS v3.1 base score is 8.1 (High) per the official advisory, though NVD assigned 9.8 (Critical) using a lower attack complexity rating (Github Advisory, 1Panel Advisory).

The root cause is improper certificate validation (CWE-295) in the HTTPS communication channel between the 1Panel Core and Agent components, compounded by command injection risk (CWE-77) through exposed high-privilege interfaces. Specifically, the Agent's TLS server was configured with tls.RequireAnyClientCert instead of tls.RequireAndVerifyClientCert, meaning any self-signed certificate would pass the TLS handshake. The subsequent middleware check in agent/middleware/certificate.go only verified that the certificate's CN field equaled panel_client without validating the certificate issuer or CA chain. Additionally, WebSocket connections could bypass Proxy-ID verification entirely. This allowed an attacker to generate a self-signed certificate with CN=panel_client and gain unauthorized access to sensitive WebSocket endpoints including /hosts/terminal (arbitrary command execution), /process/ws (process enumeration), and /containers/terminal (container command execution) (1Panel Advisory, Patch PR).

Successful exploitation grants an unauthenticated network attacker full remote code execution on the managed Linux server with the privileges of the 1Panel service account. An attacker can enumerate all running processes and network connections, execute arbitrary shell commands via the terminal WebSocket interface, interact with containers, and download arbitrary files. This enables complete system compromise including data exfiltration, persistent backdoor installation, lateral movement to other managed nodes, and disruption of hosted services (websites, databases, containers, and LLMs managed by 1Panel) (Github Advisory, 1Panel Advisory).

Multiple public proof-of-concept exploits are available on GitHub, including repositories at anonnymous5/1Panel-CVE-2025-54424, hophtien/CVE-2025-54424, and Mr-xn/CVE-2025-54424, as well as a listing on Sploitus. No credentials or prior access are required for exploitation — only network access to the Agent port. The EPSS score is approximately 1.19% (79th percentile), indicating elevated exploitation probability relative to other CVEs. There is no confirmed evidence of in-the-wild exploitation at this time, and the vulnerability is not currently listed in the CISA KEV catalog (Github Advisory, Feedly).

1. Reconnaissance: Identify internet-facing 1Panel instances running version 2.0.5 or earlier using Shodan, Censys, or similar tools, targeting the Agent's HTTPS port (default varies by deployment).
2. Generate a forged certificate: Create a self-signed TLS certificate with the CN field set to panel_client using OpenSSL:

   openssl req -x509 -newkey rsa:2048 -keyout panel_client.key -out panel_client.crt -days 365 -nodes -subj "/CN=panel_client"

3. Establish TLS connection: Use the forged certificate to initiate a TLS connection to the Agent endpoint. Because the server uses tls.RequireAnyClientCert, any self-signed certificate passes the handshake, and the middleware only checks the CN field — not the issuing CA.
4. Connect to privileged WebSocket endpoint: Establish a WebSocket connection to /hosts/terminal (or /containers/terminal) using the forged certificate, bypassing Proxy-ID verification.
5. Execute arbitrary commands: Send a WebSocket message with a base64-encoded command to achieve RCE:

   {"type": "cmd", "data": "d2hvYW1pCg=="}

   (where d2hvYW1pCg== is the base64 encoding of whoami\n). Replace the payload with any desired shell command to achieve full system compromise (1Panel Advisory, Github Advisory).

• Network: Unexpected TLS connections to the 1Panel Agent port from external or untrusted IP addresses; WebSocket upgrade requests to /hosts/terminal, /process/ws, /containers/terminal, or /files/wget/process from unauthorized sources; outbound connections from the server to unknown external IPs following Agent access.
• Logs: 1Panel Agent access logs showing WebSocket connections to sensitive endpoints (/hosts/terminal, /process/ws) from IPs not belonging to the Core server; TLS handshake completions with certificates not issued by the expected internal CA; requests with Connection: Upgrade headers to privileged routes from unexpected sources.
• File System: Unexpected new files, scripts, cron jobs, or SSH authorized keys created on the server; web shells or reverse shell binaries dropped in world-writable directories; new user accounts or modifications to /etc/passwd or /etc/sudoers.
• Process: Unusual child processes spawned by the 1Panel Agent process (e.g., bash, sh, curl, wget, python, nc); unexpected outbound network connections initiated by the 1Panel service account (1Panel Advisory).

The primary remediation is to upgrade 1Panel to version 2.0.6 or later, which changes the TLS configuration from tls.RequireAnyClientCert to tls.RequireAndVerifyClientCert and enforces CA-based certificate validation in agent/middleware/certificate.go. For systems that cannot be immediately patched, implement network-level controls (firewall rules, security groups) to restrict access to the Core-Agent communication port to only trusted internal IP addresses. Monitor for suspicious authentication attempts and unexpected command execution activity on affected systems (1Panel Release, Patch PR).

The vulnerability received coverage in security blogs and community media shortly after disclosure, including articles on Medium, Dev.to, and System Weakness describing it as a "Critical RCE" in 1Panel. CISA included it in their weekly vulnerability bulletin (SB25-216). The security community noted the availability of multiple public PoC exploits as a significant risk amplifier. RedPacket Security and other automated security feeds also flagged the CVE shortly after publication (CISA Bulletin, Medium).