CVE-2023-37477 (Go, published 2023-07-18T19:15Z)
Description: value: 1Panel is an open source Linux server operation and maintenance management panel. An OS command injection vulnerability exists in 1Panel firewall functionality. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability. 1Panel firewall functionality `/hosts/firewall/ip` endpoint read user input without validation, the attacker extends the default functionality of the application, which execute system commands. An attacker can execute arbitrary code on the target system, which can lead to a complete compromise of the system. This issue has been addressed in commit `e17b80cff49` which is included in release version `1.4.3`. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/1Panel-dev/1Panel
Files changed:
backend/app/service/container.go
backend/app/service/container_compose.go
backend/app/service/database_mysql.go
backend/app/service/firewall.go
backend/app/service/image_repo.go
backend/app/service/ssh.go
backend/constant/errs.go
backend/i18n/lang/en.yaml
backend/i18n/lang/zh-Hant.yaml
backend/i18n/lang/zh.yaml
backend/utils/firewall/client/firewalld.go
backend/utils/firewall/client/ufw.go
Commit message: fix: 解决部分接口命令注入问题 (#1690)




Vulnerable code:

		return buserr.New(constant.ErrRepoConn)
		return buserr.New(constant.ErrRepoConn)
	ErrRepoConn     = "ErrRepoConn"
ErrRepoConn: "The repository information contains illegal characters"
ErrRepoConn: "倉庫資訊中存在不合法的字符"
ErrRepoConn: "仓库信息中存在不合法的字符"

Fixed code:
	"github.com/1Panel-dev/1Panel/backend/utils/cmd"
	if cmd.CheckIllegal(container, since, tail) {
		return buserr.New(constant.ErrCmdIllegal)
	}
	"github.com/1Panel-dev/1Panel/backend/buserr"
	"github.com/1Panel-dev/1Panel/backend/utils/cmd"
	if cmd.CheckIllegal(req.Path) {
		return false, buserr.New(constant.ErrCmdIllegal)
	}
	if cmd.CheckIllegal(req.Name, req.Path) {
		return "", buserr.New(constant.ErrCmdIllegal)
	}
	if cmd.CheckIllegal(req.Path, req.Operation) {
		return buserr.New(constant.ErrCmdIllegal)
	}
	if cmd.CheckIllegal(req.Name, req.Path) {
		return buserr.New(constant.ErrCmdIllegal)
	}
	"github.com/1Panel-dev/1Panel/backend/utils/cmd"
	if cmd.CheckIllegal(req.Name, req.Username, req.Password, req.Format, req.Permission) {
		return nil, buserr.New(constant.ErrCmdIllegal)
	}

	if cmd.CheckIllegal(info.Value) {
		return buserr.New(constant.ErrCmdIllegal)
	}

	if cmd.CheckIllegal(info.Value) {
		return buserr.New(constant.ErrCmdIllegal)
	}
		return buserr.New(constant.ErrCmdIllegal)
		return buserr.New(constant.ErrCmdIllegal)
	"github.com/1Panel-dev/1Panel/backend/buserr"
	if cmd.CheckIllegal(req.EncryptionMode, req.Password) {
		return buserr.New(constant.ErrCmdIllegal)
	}
	ErrCmdIllegal          = "ErrCmdIllegal"
ErrCmdIllegal: "The command contains illegal characters. Please modify and try again!"
ErrCmdIllegal: "執行命令中存在不合法字符，請修改後重試！"
ErrCmdIllegal: "执行命令中存在不合法字符，请修改后重试！"
	"github.com/1Panel-dev/1Panel/backend/buserr"
	"github.com/1Panel-dev/1Panel/backend/constant"
	if cmd.CheckIllegal(operation, port.Protocol, port.Port) {
		return buserr.New(constant.ErrCmdIllegal)
	}

	if cmd.CheckIllegal(operation, rule.Address, rule.Protocol, rule.Port, rule.Strategy) {
		return buserr.New(constant.ErrCmdIllegal)
	}
	"github.com/1Panel-dev/1Panel/backend/buserr"
	"github.com/1Panel-dev/1Panel/backend/constant"
	if cmd.CheckIllegal(port.Protocol, port.Port) {
		return buserr.New(constant.ErrCmdIllegal)
	}
	if cmd.CheckIllegal(operation, rule.Protocol, rule.Address, rule.Port) {
		return buserr.New(constant.ErrCmdIllegal)
	}