CVE-2025-66508: 
vulnerability analysis and mitigation

CVE-2025-66508 is an IP access control bypass vulnerability in 1Panel, an open-source web-based Linux server management control panel developed by Fit2Cloud. The vulnerability allows unauthenticated remote attackers to spoof the X-Forwarded-For HTTP header to impersonate trusted IP addresses, bypassing all IP-based access controls. It affects all versions of 1Panel prior to v2.0.14 and was disclosed on December 8, 2025. The CVSS v3.1 base score is 6.5 (Medium) (Github Advisory, 1Panel Security Advisory).

The root cause is classified as CWE-290 (Authentication Bypass by Spoofing). 1Panel's backend is built using the Go Gin web framework, which is initialized with gin.Default(). This default configuration sets TrustedProxies = 0.0.0.0/0, meaning Gin trusts all IP addresses as legitimate reverse proxies and unconditionally accepts the X-Forwarded-For and X-Real-IP headers to compute ClientIP(). Since all IP-based security controls — including AllowIPs/BindDomain checks (core/middleware/ip_limit.go, core/utils/security/security.go), the API IP whitelist (core/middleware/api_auth.go), and localhost-only restrictions — rely on ClientIP(), any remote attacker can send a crafted X-Forwarded-For: 127.0.0.1 (or any whitelisted IP) header to be treated as a trusted source (1Panel Security Advisory, Github Advisory).

Successful exploitation renders all IP-based access controls in 1Panel completely ineffective. Remote, unauthenticated attackers can masquerade as localhost or any whitelisted IP address, gaining unauthorized access to management APIs, administrative interfaces, and features restricted to trusted networks. This results in low confidentiality and integrity impacts — attackers may read sensitive server configuration data and perform unauthorized management actions — though availability is not directly affected (1Panel Security Advisory, Github Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (Github Advisory). The vulnerability requires no authentication, no user interaction, and has low attack complexity, making it trivially exploitable by any network-accessible attacker. The EPSS score is approximately 0.027% (0.000270), indicating a low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify internet-facing 1Panel instances (versions prior to 2.0.14) using tools like Shodan or Censys, searching for the 1Panel web interface on common ports.
2. Identify protected endpoints: Determine which API endpoints or management functions are restricted by IP-based controls (e.g., API whitelist endpoints, localhost-only admin functions).
3. Craft spoofed request: Construct an HTTP request to the target 1Panel endpoint and add the header X-Forwarded-For: 127.0.0.1 (or another whitelisted IP address) to the request.
4. Bypass IP access control: Because Gin's ClientIP() trusts the spoofed header unconditionally, the server evaluates the request as originating from 127.0.0.1, bypassing AllowIPs, API IP whitelist, and localhost-only checks.
5. Access restricted functionality: With IP controls bypassed, interact with protected management APIs or administrative features that would otherwise be blocked for remote clients (1Panel Security Advisory, Github Advisory).

• Network: HTTP requests to 1Panel management endpoints containing X-Forwarded-For: 127.0.0.1 or other internal/whitelisted IP addresses originating from external or untrusted source IPs; unusual access patterns to API endpoints from unexpected source addresses.
• Logs: 1Panel access logs showing requests from external IPs that successfully accessed localhost-restricted or IP-whitelisted endpoints; discrepancies between the actual source IP and the IP recorded by the application due to header spoofing.
• Application Behavior: Successful API calls or administrative actions from IP addresses that should be blocked by configured AllowIPs or API whitelist rules.

The vendor has released a patch in 1Panel v2.0.14, which addresses the default Gin proxy trust configuration. Users should upgrade to v2.0.14 or later immediately (Github Advisory, 1Panel Security Advisory). As interim mitigations, administrators should: (1) restrict network-level access to the 1Panel interface using firewalls so it is not reachable from untrusted networks; (2) implement additional authentication mechanisms beyond IP-based controls; and (3) review and restrict X-Forwarded-For header handling at the reverse proxy or load balancer layer to prevent header injection from untrusted clients.

The vulnerability was reported by security researcher "Threonine" and published by the 1Panel maintainer wanghe-fit2cloud on December 8, 2025 (1Panel Security Advisory). No significant broader media coverage or notable community commentary beyond the advisory has been identified.