CVE-2024-2352

Name of the Vulnerable Software and Affected Versions 1Panel versions up to 1.10.1-lts

Description A critical issue has been found in the function baseApi.UpdateDeviceSwap of the file /api/v1/toolbox/device/update/swap. The manipulation of the argument Path with a specific input leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Recommendations To fix this issue, apply a patch to the affected version of 1Panel. As a temporary workaround, consider restricting access to the /api/v1/toolbox/device/update/swap endpoint until a patch is available. Avoid using the Path argument in the affected API endpoint until the issue is resolved.