1Panel contains a cross-site request forgery (CSRF) vulnerability in the web port configuration functionality

The primary impact of this CSRF vulnerability is the ability for an attacker to modify the port on which the 1Panel web service listens. By crafting a malicious webpage and enticing an authenticated user to visit it, an attacker can trigger a port change request. This change effectively redirects traffic away from the original port, rendering the service inaccessible on that port. This can lead to significant service disruption, impacting users and potentially causing data loss if the original port was critical for specific functionalities. While the vulnerability doesn't directly expose sensitive data, the resulting service disruption could be leveraged for denial-of-service (DoS) attacks or as a precursor to further exploitation.

Organizations utilizing 1Panel for web hosting, particularly those with publicly accessible instances, are at risk. Shared hosting environments are especially vulnerable as multiple users share the same infrastructure, increasing the potential for cross-site request forgery attacks. Users relying on 1Panel's web service for critical applications or services should prioritize mitigation and patching.

• linux / server: Monitor 1Panel access logs for unusual port change requests originating from unexpected IP addresses or user agents. Use journalctl -u 1Panel to check for error messages related to invalid requests. • generic web: Use curl -v <1Panel_URL>/port-change while logged in to observe the request headers and confirm the absence of anti-CSRF tokens. • wordpress / composer / npm: N/A - This vulnerability is not specific to these components. • database (mysql, redis, mongodb, postgresql): N/A - This vulnerability does not directly impact databases. • windows / supply-chain: N/A - 1Panel is primarily a Linux-based application.

1. 2025-12-10Disclosure

   disclosure

1. Reservado2025-04-15
2. Publicada2025-12-10
3. Modificada2025-12-23
4. EPSS actualizado2026-03-23

The immediate mitigation for CVE-2025-34429 involves implementing robust CSRF defenses. While a patched version is the ultimate solution, temporary workarounds include configuring a Web Application Firewall (WAF) to block suspicious port change requests. Specifically, WAF rules should be configured to inspect the Origin and Referer headers of requests to the port-change endpoint, rejecting requests from unexpected origins. Additionally, implementing Origin/Referer validation within the 1Panel application itself, even as a temporary measure, can significantly reduce the attack surface. Until a patch is available, restrict access to the port configuration functionality to trusted users and networks. After a future upgrade, confirm the vulnerability is resolved by attempting a CSRF attack on the port-change endpoint and verifying that the request is rejected.