{"id":"GHSA-x2vg-5wrf-vj6v","summary":"1Panel is vulnerable to command injection ","details":"1Panel is vulnerable to command injection. This vulnerability has been classified as critical, has been found in 1Panel up to 1.10.1-lts. Affected by this issue is the function baseApi.UpdateDeviceSwap of the file /api/v1/toolbox/device/update/swap. The manipulation of the argument Path with the input 123123123\\nopen -a Calculator leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-256304.","aliases":["CVE-2024-2352","GO-2024-2636"],"modified":"2024-06-04T16:56:41.720865Z","published":"2024-03-10T03:30:45Z","database_specific":{"github_reviewed_at":"2024-03-11T14:00:13Z","nvd_published_at":"2024-03-10T02:16:08Z","cwe_ids":["CWE-77"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-2352"},{"type":"WEB","url":"https://github.com/1Panel-dev/1Panel/pull/4131"},{"type":"WEB","url":"https://github.com/1Panel-dev/1Panel/pull/4131#issue-2176105990"},{"type":"WEB","url":"https://github.com/1Panel-dev/1Panel/pull/4131/commits/0edd7a9f6f5100aab98a0ea6e5deedff7700396c"},{"type":"PACKAGE","url":"https://github.com/1Panel-dev/1Panel"},{"type":"WEB","url":"https://vuldb.com/?ctiid.256304"},{"type":"WEB","url":"https://vuldb.com/?id.256304"}],"affected":[{"package":{"name":"github.com/1Panel-dev/1Panel","ecosystem":"Go","purl":"pkg:golang/github.com/1Panel-dev/1Panel"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.10.1-lts"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/03/GHSA-x2vg-5wrf-vj6v/GHSA-x2vg-5wrf-vj6v.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"}]}