CVE-2024-39907
Published: 18 July 2024
Summary
CVE-2024-39907 is a critical-severity SQL Injection (CWE-89) vulnerability in Fit2Cloud 1Panel. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 0.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
1Panel is a web-based Linux server management control panel that contains multiple SQL injection vulnerabilities tracked under CWE-89. Several of these injections are insufficiently filtered, allowing the flaws to be chained into arbitrary file writes that culminate in remote code execution. The issues affect versions prior to 1.10.12-tls and are rated 9.8 on CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
An unauthenticated attacker with network access can supply crafted input to trigger the SQL injections, write arbitrary files to the server, and ultimately execute code, resulting in complete compromise of the managed host.
The vulnerabilities are fixed in version 1.10.12-tls. The project advisory states that users should upgrade and notes that no workarounds are known; further details are provided in GitHub Security Advisory GHSA-5grx-v727-qmq6. The associated EPSS score has remained high since disclosure, with a current value of 0.8421 and a peak of 0.8577.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-2266
Vulnerability details
1Panel is a web-based linux server management control panel. There are many sql injections in the project, and some of them are not well filtered, leading to arbitrary file writes, and ultimately leading to RCEs. These sql injections have been…
more
resolved in version 1.10.12-tls. Users are advised to upgrade. There are no known workarounds for these issues.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The SQL injection vulnerability in the web-based 1Panel API (orderBy clause) enables exploitation of a public-facing application (T1190) for remote code execution via arbitrary file writes and facilitates data exfiltration from databases (T1213.006) through arbitrary SQL queries.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.