a sqlinjection in 1Panel

The impact of CVE-2024-39907 is severe. Successful exploitation allows an attacker to inject malicious SQL code into 1Panel's database queries. This injected code can then be leveraged to write arbitrary files to the server's file system. The ability to write files grants an attacker the potential to overwrite critical system files, install malware, or gain persistent access to the server. The ultimate consequence is remote code execution, giving the attacker complete control over the compromised server. Given 1Panel's role as a server management tool, a successful attack could lead to widespread compromise of the managed services and data.

Organizations and individuals using 1Panel to manage their Linux servers are at risk. This includes those relying on 1Panel for hosting websites, applications, or other services. Shared hosting environments utilizing 1Panel are particularly vulnerable, as a compromise of one user's account could potentially lead to the compromise of the entire server.

• linux / server:

journalctl -u 1panel | grep -i "sql error"

• linux / server:

ps aux | grep -i "1panel"

• generic web:

curl -I http://<1panel_ip>/api/  # Check for exposed API endpoints

1. 2024-07-18Disclosure

   disclosure

1. 已保留2024-07-02
2. 发布日期2024-07-18
3. 修改日期2024-08-02
4. EPSS 更新日期2026-04-02

The primary mitigation for CVE-2024-39907 is to immediately upgrade 1Panel to version 1.10.12-tls or later. Due to the nature of the vulnerability (SQL injection leading to arbitrary file writes), there are no known workarounds beyond patching. Consider implementing stricter database access controls and input validation as a preventative measure against future SQL injection vulnerabilities. Regularly audit 1Panel configurations and user permissions to minimize the attack surface. After upgrading, verify the integrity of critical system files and review 1Panel logs for any signs of suspicious activity.