CVE-2024-30257 1Panel's password verification is suspected to have a timing attack vulnerability
Attackers can exploit timing differences in password verification to bypass authentication and gain unauthorized access to the 1Panel management interface.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-30257?
CVE-2024-30257 is a low-severity vulnerability in 1Panel-dev 1Panel, published on 18 Apr 2024. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
1Panel is an open source Linux server operation and maintenance management panel. The password verification in the source code uses the != symbol instead hmac.Equal. This may lead to a timing attack vulnerability. This vulnerability is fixed in 1.10.3-lts.
Weakness: CWE-203
Which versions are affected by CVE-2024-30257?
3 open source packages ship an affected version, including github.com/1Panel-dev/1Panel. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/1Panel-dev/1Panel Go | All versions | None |
github.com/1Panel-dev/1Panel Go | All versions | 1.10.3 |
github.com/1Panel-dev/1Panel Go | All versions | 1.10.3 |
Products include Fit2cloud 1panel.
How do I fix CVE-2024-30257?
Upgrade github.com/1Panel-dev/1Panel to 1.10.3 or later.
Is CVE-2024-30257 being exploited?
There is no known exploitation of CVE-2024-30257 in the wild and no public exploit code.
Other vulnerabilities in 1Panel-dev 1Panel
Sources
Also known as GHSA-6m9h-2pr2-9j8f, GO-2024-2734.