1Panel swap baseApi.UpdateDeviceSwap command injection

Vulnerability

Overview

The vulnerability resides in the baseApi.UpdateDeviceSwap function of 1Panel, an open-source server management panel. The endpoint /api/v1/toolbox/device/update/swap takes a Path argument that is passed directly to a shell command (swapoff) via cmd.Execf. The application includes a CheckIllegal function that blocks many shell metacharacters like &, |, ;, $, but it does not filter the newline character (\n). An attacker can inject a newline to terminate the intended command and execute arbitrary system commands [1][3].

Exploitation

The attack is remotely exploitable without authentication. By sending a crafted POST request to the vulnerable endpoint, an attacker can include a newline followed by any command in the Path parameter. For example, the value 123123123\nopen -a Calculator would execute the Calculator application on macOS (though in a real attack, a reverse shell or data exfiltration command would be used). The exploit has been publicly disclosed and a proof-of-concept packet is available [1][3][4].

Impact

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary commands with the privileges of the 1Panel server process. This can lead to full compromise of the server, including data theft, installation of malware, or further lateral movement within the network. Given that 1Panel is often deployed on VPS hosting sensitive applications, the impact is critical [1][2].

Mitigation

The issue was fixed in pull request #4131 on GitHub, which addresses the command injection by improving input validation and escaping [3][4]. Users should upgrade to a patched version (beyond 1.10.1-lts) as soon as possible. No workaround is available; the only remediation is to apply the patch.