Executive brief
1Panel is an open-source Linux control panel used to manage server operations and Docker containers. A vulnerability in the container log search feature allows an attacker to write malicious files to the host server. This could lead to a complete takeover of the server, including the ability to execute commands with root privileges or modify sensitive system files like SSH keys.
Technical details
A command injection vulnerability exists in 1Panel's container log search functionality (specifically the `/api/v1/containers/search/log` endpoint). The application fails to properly sanitize the `container` parameter, allowing an attacker to use shell redirection operators (e.g., '>') to write arbitrary content to the host filesystem. By deploying a malicious Docker image that generates specific output and then triggering a log search with a redirected path, an attacker can create or overwrite files such as SSH authorized_keys or cron jobs. This exploit typically requires some user interaction or a specific environment state but can result in full remote code execution (RCE) as the application often runs with root privileges. The issue is addressed in version 1.10.3-lts.
Affected products
- 1Panel-dev 1Panel < 1.10.3-lts
Timeline
- 2024-05-09: disclosed
- 2024-05-09: advisory
- 2024-05-09: patched