Improper Neutralization of Special Elements used in a Command ('Command Injection') Affecting github.com/1panel-dev/1panel/backend/utils/cmd package, versions <1.10.3-lts
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.04% (11th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GITHUBCOM1PANELDEV1PANELBACKENDUTILSCMD-6828772
- published 10 May 2024
- disclosed 9 May 2024
- credit an5er
Introduced: 9 May 2024
CVE-2024-34352 Open this link in a new tabHow to fix?
Upgrade github.com/1Panel-dev/1Panel/backend/utils/cmd to version 1.10.3-lts or higher.
Overview
Affected versions of this package are vulnerable to Improper Neutralization of Special Elements used in a Command ('Command Injection') through the API endpoint handling container logs. An attacker can write arbitrary files on the host system by manipulating the log retrieval queries to redirect output to critical system files or directories.
References
CVSS Scores
version 3.1