Executive Summary

This vulnerability exists in 1Panel versions 2.0.14 and below, where the software uses Gin's default configuration that trusts all IP addresses as proxies. This allows any client to spoof the X-Forwarded-For header. Since the application relies on the ClientIP() function for IP-based access controls, attackers can bypass these protections by sending a forged X-Forwarded-For header with a whitelisted IP address, such as 127.0.0.1. As a result, all IP-based security controls become ineffective.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to bypass IP-based security controls like AllowIPs, API whitelists, and localhost-only checks by spoofing trusted IP addresses. This means unauthorized users could gain access to restricted areas or functionalities of the 1Panel control panel, potentially leading to unauthorized management of Linux servers and exposure of sensitive information.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade 1Panel to version 2.0.14 or later, as this version fixes the issue by changing the default TrustedProxies configuration to prevent trusting all IP addresses as proxies. Until the upgrade, avoid relying solely on IP-based access controls since they can be bypassed by spoofing the X-Forwarded-For header.

Useful 0 Not Useful 0