Is CVE-2024-34352 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-34352 being exploited in the wild.

How severe is CVE-2024-34352?

Medium severity, with a CVSS score of 6.5, published 9 May 2024.

Which products and versions are affected?

1Panel-dev 1Panel < 1.10.3-lts; github.com/1Panel-dev/1Panel (Go) < 1.10.3-lts, SEMVER:introduced=0,fixed=1.10.3-lts.

Is there a fix for CVE-2024-34352?

Yes. github.com/1Panel-dev/1Panel (Go): upgrade to 1.10.3-lts or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-34352 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2024-34352?

Check whether you run 1Panel-dev 1Panel or github.com/1Panel-dev/1Panel (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-34352: 1Panel command injection in container log search API

Q: Which products and versions are affected?

1Panel-dev 1Panel < 1.10.3-lts; github.com/1Panel-dev/1Panel (Go) < 1.10.3-lts, SEMVER:introduced=0,fixed=1.10.3-lts.

Q: Is there a fix for CVE-2024-34352?

Yes. github.com/1Panel-dev/1Panel (Go): upgrade to 1.10.3-lts or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2024-34352 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2024-34352?

Check whether you run 1Panel-dev 1Panel or github.com/1Panel-dev/1Panel (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-34352 · Severity: medium · CVSS 6.5 · Published 2024-05-09

1Panel is an open-source Linux control panel used to manage server operations and Docker containers. A vulnerability in the container log search feature allows an attacker to write malicious files to the host server. This could lead to a complete takeover of the server, including the ability to execute commands with root privileges or modify sensitive system files like SSH keys.

Technologies: 1Panel-dev 1Panel, github.com/1Panel-dev/1Panel (Go). Vendors: 1Panel-dev, Go.

Quick answers

Is CVE-2024-34352 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-34352 being exploited in the wild.
How severe is CVE-2024-34352?: Medium severity, with a CVSS score of 6.5, published 9 May 2024.
Which products and versions are affected?: 1Panel-dev 1Panel < 1.10.3-lts; github.com/1Panel-dev/1Panel (Go) < 1.10.3-lts, SEMVER:introduced=0,fixed=1.10.3-lts.
Is there a fix for CVE-2024-34352?: Yes. github.com/1Panel-dev/1Panel (Go): upgrade to 1.10.3-lts or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-34352 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2024-34352?: Check whether you run 1Panel-dev 1Panel or github.com/1Panel-dev/1Panel (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/1Panel-dev/1Panel (Go): upgrade to 1.10.3-lts or later
```
go get github.com/1Panel-dev/1Panel@v1.10.3-lts
```

Technical details

A command injection vulnerability exists in 1Panel's container log search functionality (specifically the `/api/v1/containers/search/log` endpoint). The application fails to properly sanitize the `container` parameter, allowing an attacker to use shell redirection operators (e.g., '>') to write arbitrary content to the host filesystem. By deploying a malicious Docker image that generates specific output and then triggering a log search with a redirected path, an attacker can create or overwrite files such as SSH authorized_keys or cron jobs. This exploit typically requires some user interaction or a specific environment state but can result in full remote code execution (RCE) as the application often runs with root privileges. The issue is addressed in version 1.10.3-lts.

Affected products

1Panel-dev 1Panel < 1.10.3-lts

Identifiers

CVE-2024-34352
GHSA-f8ch-w75v-c847
GO-2024-2830

Timeline

2024-05-09: disclosed
2024-05-09: advisory
2024-05-09: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.