CVE-2025-34429: CSRF in 1Panel Web Port Configuration

The primary impact of this CSRF vulnerability is the ability for an attacker to modify the port on which the 1Panel web service listens. By crafting a malicious webpage and enticing an authenticated user to visit it, an attacker can trigger a port change request. This change effectively redirects traffic away from the original port, rendering the service inaccessible on that port. This can lead to significant service disruption, impacting users and potentially causing data loss if the original port was critical for specific functionalities. While the vulnerability doesn't directly expose sensitive data, the resulting service disruption could be leveraged for denial-of-service (DoS) attacks or as a precursor to further exploitation.

1. Reserved2025-04-15
2. Published2025-12-10
3. Modified2025-12-23
4. EPSS updated2026-03-23

The immediate mitigation for CVE-2025-34429 involves implementing robust CSRF defenses. While a patched version is the ultimate solution, temporary workarounds include configuring a Web Application Firewall (WAF) to block suspicious port change requests. Specifically, WAF rules should be configured to inspect the Origin and Referer headers of requests to the port-change endpoint, rejecting requests from unexpected origins. Additionally, implementing Origin/Referer validation within the 1Panel application itself, even as a temporary measure, can significantly reduce the attack surface. Until a patch is available, restrict access to the port configuration functionality to trusted users and networks. After a future upgrade, confirm the vulnerability is resolved by attempting a CSRF attack on the port-change endpoint and verifying that the request is rejected.