x/vulndb: potential Go vuln in github.com/1Panel-dev/1Panel: CVE-2023-37477

[GoVulnBot]

CVE-2023-37477 references github.com/1Panel-dev/1Panel, which may be a Go module.

Description:
1Panel is an open source Linux server operation and maintenance management panel. An OS command injection vulnerability exists in 1Panel firewall functionality. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability. 1Panel firewall functionality /hosts/firewall/ip endpoint read user input without validation, the attacker extends the default functionality of the application, which execute system commands. An attacker can execute arbitrary code on the target system, which can lead to a complete compromise of the system. This issue has been addressed in commit e17b80cff49 which is included in release version 1.4.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-37477
• JSON: https://github.com/CVEProject/cvelist/tree/3cca5c8c59340277eb103a4c15fcf20e117185f5/2023/37xxx/CVE-2023-37477.json
• advisory: GHSA-p9xf-74xh-mhw5
• fix: 1Panel-dev/1Panel@e17b80c
• Imported by: https://pkg.go.dev/github.com/1Panel-dev/1Panel?tab=importedby

Cross references:

• Module github.com/1Panel-dev/1Panel appears in issue x/vulndb: potential Go vuln in github.com/1Panel-dev/1Panel: CVE-2023-36457 #1887 NOT_IMPORTABLE
• Module github.com/1Panel-dev/1Panel appears in issue x/vulndb: potential Go vuln in github.com/1Panel-dev/1Panel: CVE-2023-36458 #1888 EFFECTIVELY_PRIVATE

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/1Panel-dev/1Panel
      vulnerable_at: 1.4.3
      packages:
        - package: 1Panel
description: |-
    1Panel is an open source Linux server operation and maintenance management
    panel. An OS command injection vulnerability exists in 1Panel firewall
    functionality. A specially-crafted HTTP request can lead to arbitrary command
    execution. An attacker can make an authenticated HTTP request to trigger this
    vulnerability. 1Panel firewall functionality `/hosts/firewall/ip` endpoint read
    user input without validation, the attacker extends the default functionality of
    the application, which execute system commands. An attacker can execute
    arbitrary code on the target system, which can lead to a complete compromise of
    the system. This issue has been addressed in commit `e17b80cff49` which is
    included in release version `1.4.3`. Users are advised to upgrade. There are no
    known workarounds for this vulnerability.
cves:
    - CVE-2023-37477
references:
    - advisory: https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-p9xf-74xh-mhw5
    - fix: https://github.com/1Panel-dev/1Panel/commit/e17b80cff4975ee343568ff526b62319f499005d

[gopherbot]

Change https://go.dev/cl/513195 mentions this issue: data/excluded: batch add 26 excluded reports

[gopherbot]

Change https://go.dev/cl/592762 mentions this issue: data/reports: unexclude 75 reports

[gopherbot]

Change https://go.dev/cl/606788 mentions this issue: data/reports: unexclude 20 reports (8)