CVE-2025-56413
BaseFortify
Publication date: 2025-09-10
Last updated on: 2025-11-18
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| fit2cloud | 1panel | 2.0.8 |
| 1panel | 1panel | 2.0.8 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-56413 is an OS command injection vulnerability in the OperateSSH function of 1Panel version 2.0.8. The vulnerability occurs because the 'operation' parameter sent to the /api/v2/hosts/ssh/operate endpoint is not properly validated and is directly passed to a system command. This allows attackers to inject arbitrary OS commands by including them in the 'operation' parameter, leading to unauthorized command execution on the server. [1]
How can this vulnerability impact me? :
This vulnerability can allow attackers to execute arbitrary operating system commands on the affected server running 1Panel 2.0.8. This can lead to unauthorized access, data compromise, creation of malicious files, lateral movement within the network, and potentially full system compromise depending on the privileges of the 1Panel application. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection can be performed by monitoring for suspicious POST requests to the /api/v2/hosts/ssh/operate endpoint containing command injection metacharacters such as semicolons (;), backticks (`), pipes (|), or ampersands (&). For example, inspecting web server logs or using network monitoring tools to filter for such patterns can help identify exploitation attempts. Commands like 'grep -E ";|`|\||&" /var/log/nginx/access.log' or similar on relevant logs can be used. Additionally, checking for unexpected files such as /tmp/pwned created by proof-of-concept exploits may indicate compromise. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include deploying a Web Application Firewall (WAF) such as ModSecurity or cloud-based WAFs to block POST requests to /api/v2/hosts/ssh/operate containing command injection characters. Network isolation of the 1Panel server to restrict unnecessary inbound and outbound connections is recommended to limit attacker movement. Also, ensure the 1Panel application runs under a low-privileged user account rather than root to reduce potential damage from exploitation. Ultimately, applying a patch that enforces strict whitelist validation on the operation parameter is necessary for a complete fix. [1]