CVE-2024-24768: Missing Encryption of Sensitive Data (CWE-311)
value: 1Panel is an open source Linux server operation and maintenance management panel. The HTTPS cookie that comes with the panel does not have the Secure keyword, which may cause the cookie to be sent in plain text if accessed using HTTP. This issue has been patched in version 1.9.6.


CWE description: The product does not encrypt sensitive or critical information before storage or transmission.
CVSS v3 base score: 7.5
Published: 2024-02-05T15:15Z
Repository: https://github.com/1Panel-dev/1Panel
Language: Go
Files changed: backend/app/service/auth.go, backend/app/service/setting.go
Commit date: 2024-02-04 22:46:33 +0800
Commit message: feat: 面板开启 https 时，cookie 开启 secure 属性 (#3817)


Diff: diff --git a/backend/app/service/auth.go b/backend/app/service/auth.go
index 017055c4a..ff5635441 100644
--- a/backend/app/service/auth.go
+++ b/backend/app/service/auth.go
@@ -107,10 +107,14 @@ func (u *AuthService) MFALogin(c *gin.Context, info dto.MFALogin, entrance strin
 func (u *AuthService) generateSession(c *gin.Context, name, authMethod string) (*dto.UserLoginInfo, error) {
 	setting, err := settingRepo.Get(settingRepo.WithByKey("SessionTimeout"))
 	if err != nil {
 		return nil, err
 	}
+	httpsSetting, err := settingRepo.Get(settingRepo.WithByKey("SSL"))
+	if err != nil {
+		return nil, err
+	}
 	lifeTime, err := strconv.Atoi(setting.Value)
 	if err != nil {
 		return nil, err
 	}
 
@@ -127,11 +131,11 @@ func (u *AuthService) generateSession(c *gin.Context, name, authMethod string) (
 	}
 	sID, _ := c.Cookie(constant.SessionName)
 	sessionUser, err := global.SESSION.Get(sID)
 	if err != nil {
 		sID = uuid.New().String()
-		c.SetCookie(constant.SessionName, sID, 0, "", "", false, false)
+		c.SetCookie(constant.SessionName, sID, 0, "", "", httpsSetting.Value == "enable", false)
 		err := global.SESSION.Set(sID, sessionUser, lifeTime)
 		if err != nil {
 			return nil, err
 		}
 		return &dto.UserLoginInfo{Name: name}, nil
@@ -142,13 +146,17 @@ func (u *AuthService) generateSession(c *gin.Context, name, authMethod string) (
 
 	return &dto.UserLoginInfo{Name: name}, nil
 }
 
 func (u *AuthService) LogOut(c *gin.Context) error {
+	httpsSetting, err := settingRepo.Get(settingRepo.WithByKey("SSL"))
+	if err != nil {
+		return err
+	}
 	sID, _ := c.Cookie(constant.SessionName)
 	if sID != "" {
-		c.SetCookie(constant.SessionName, sID, -1, "", "", false, false)
+		c.SetCookie(constant.SessionName, sID, -1, "", "", httpsSetting.Value == "enable", false)
 		err := global.SESSION.Delete(sID)
 		if err != nil {
 			return err
 		}
 	}
diff --git a/backend/app/service/setting.go b/backend/app/service/setting.go
index 1be472be8..8077ae9f7 100644
--- a/backend/app/service/setting.go
+++ b/backend/app/service/setting.go
@@ -196,10 +196,13 @@ func (u *SettingService) UpdateSSL(c *gin.Context, req dto.SSLUpdate) error {
 		if err := settingRepo.Update("SSLType", "self"); err != nil {
 			return err
 		}
 		_ = os.Remove(path.Join(secretDir, "server.crt"))
 		_ = os.Remove(path.Join(secretDir, "server.key"))
+		sID, _ := c.Cookie(constant.SessionName)
+		c.SetCookie(constant.SessionName, sID, 0, "", "", false, false)
+
 		go func() {
 			_, err := cmd.Exec("systemctl restart 1panel.service")
 			if err != nil {
 				global.LOG.Errorf("restart system failed, err: %v", err)
 			}
@@ -287,10 +290,13 @@ func (u *SettingService) UpdateSSL(c *gin.Context, req dto.SSLUpdate) error {
 		return err
 	}
 	if err := settingRepo.Update("SSL", req.SSL); err != nil {
 		return err
 	}
+
+	sID, _ := c.Cookie(constant.SessionName)
+	c.SetCookie(constant.SessionName, sID, 0, "", "", true, false)
 	go func() {
 		time.Sleep(1 * time.Second)
 		_, err := cmd.Exec("systemctl restart 1panel.service")
 		if err != nil {
 			global.LOG.Errorf("restart system failed, err: %v", err)

Vulnerable code: 		c.SetCookie(constant.SessionName, sID, 0, "", "", false, false)
		c.SetCookie(constant.SessionName, sID, -1, "", "", false, false)
Fixed code: 	httpsSetting, err := settingRepo.Get(settingRepo.WithByKey("SSL"))
	if err != nil {
		return nil, err
	}
		c.SetCookie(constant.SessionName, sID, 0, "", "", httpsSetting.Value == "enable", false)
	httpsSetting, err := settingRepo.Get(settingRepo.WithByKey("SSL"))
	if err != nil {
		return err
	}
		c.SetCookie(constant.SessionName, sID, -1, "", "", httpsSetting.Value == "enable", false)
		sID, _ := c.Cookie(constant.SessionName)
		c.SetCookie(constant.SessionName, sID, 0, "", "", false, false)


	sID, _ := c.Cookie(constant.SessionName)
	c.SetCookie(constant.SessionName, sID, 0, "", "", true, false)