CVE-2024-30257Medium· 5.9▾ Sunlit1Panel's password verification is suspected to have a timing attack vulnerability
▾ Sunlit zone — Low / medium · no exploitation signal
impact 32.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.4%
源码中密码校验处使用 != 符号，而不是hmac.Equal，这可能导致产生计时攻击漏洞，从而爆破密码。
建议使用 hmac.Equal 比对密码。
Translation:
The source code uses the != symbol instead of hmac.Equal for password verification, which may lead to timing attack vulnerabilities that can lead to password cracking. It is recommended to use hmac. Equal to compare passwords.
https://github.com/1Panel-dev/1Panel/blob/dev/backend/app/service/auth.go#L81C5-L81C26
该产品的所有使用者。
Translation:
All users of this product.
github.com/1Panel-dev/1Panel < 1.10.3Upgrade to a patched release:
github.com/1Panel-dev/1Panel 1.10.3Connected by shared product, vendor, weakness, or advisory.
CVE-2023-39965Medium· 6.51Panel Arbitrary File Download vulnerability
CVE-2023-36458Medium· 6.31Panel vulnerable to command injection when entering the container terminal
CVE-2024-39907Critical· 9.81Panel has an SQL injection issue related to the orderBy clause
CVE-2024-27288Medium· 6.31Panel open source panel project has an unauthorized vulnerability.
CVE-2026-79919Medium· 6.3MaxKB is an open-source AI assistant for enterprise
CVE-2026-79918Medium· 6.3MaxKB is an open-source AI assistant for enterprise