1Panel には、パネル名管理機能にクロスサイトリクエストフォージェリ (CSRF) の脆弱性が存在します

The primary impact of this CSRF vulnerability is the ability for an attacker to modify a victim's 1Panel panel name. This could be used for malicious purposes such as impersonation, phishing attacks, or simply disrupting the user experience. An attacker could craft a malicious webpage containing a request to change the panel name. If a user visits this page while authenticated in 1Panel, their session cookies will be automatically included in the request, allowing the attacker to successfully change the panel name to an arbitrary value. While the immediate impact may seem limited, it can be a stepping stone for further attacks or used to create confusion and distrust among users.

Users of 1Panel versions 1.10.33 through 2.0.15 are at risk. This includes individuals and organizations relying on 1Panel for web hosting and server management. Shared hosting environments where multiple users share the same 1Panel instance are particularly vulnerable, as an attacker could potentially target other users within the same environment.

• linux / server: Monitor 1Panel logs for suspicious panel name change requests. Look for requests originating from unexpected IP addresses or with unusual user agents.

journalctl -u 1Panel -f | grep 'panel name changed'

• generic web: Inspect HTTP requests to the panel name management endpoint for missing or invalid CSRF tokens. Use curl to manually test the endpoint with crafted requests.

curl -X POST -d 'new_panel_name=MaliciousName' <panel_name_endpoint>

1. 2025-12-10Disclosure

   disclosure

1. 予約済み2025-04-15
2. 公開日2025-12-10
3. 更新日2025-12-23
4. EPSS 更新日2026-03-23

The recommended mitigation for CVE-2025-34430 is to upgrade 1Panel to a version that includes the fix. Unfortunately, the specific fixed version is not provided. Until an updated version is available, consider implementing temporary workarounds such as restricting access to the panel name management functionality to trusted users or implementing stricter authentication measures. Web application firewalls (WAFs) can be configured to detect and block suspicious CSRF requests based on patterns and referer checks. Monitor 1Panel logs for unusual panel name changes.