Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-27288

CVE-2024-27288: 1Panel open source panel project has an unauthorized vulnerability.

6.3

CVSS Score
3.1

Basic Information

CVE ID
CVE-2024-27288
GHSA ID
GHSA-26w3-q4j8-4xjp
EPSS Score
0.55599%
CWE
CWE-863
Published
3/6/2024
Updated
2/11/2025
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Package NameEcosystemVulnerable VersionsFirst Patched Version
github.com/1Panel-dev/1Panelgo<= 1.10.0-lts1.10.1-lts

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from incorrect authorization (CWE-863) in route handling. The fix in PR #4014 addressed a login page redirect issue, which correlates with authentication flow control. The release notes specifically mention this PR fixed the unauthorized access vulnerability. In Go web applications, route initialization (typically in router.go) is where authentication middleware would be applied. The vulnerability likely existed because critical console routes were not properly protected by authentication checks in the router configuration prior to the patch.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t T** st*ps *r* *s *ollows: *. ****ss *ttps://IP:PORT/ in t** *rows*r, w*i** prompts t** us*r to ****ss wit* * s**ur* *ntry point. ![im***](*ttps://*it*u*.*om/*P*n*l-**v/*P*n*l/*ss*ts/********/********-****-****-****-************) *. Us*

Reasoning

T** vuln*r**ility st*ms *rom in*orr**t *ut*oriz*tion (*W*-***) in rout* **n*lin*. T** *ix in PR #**** ***r*ss** * lo*in p*** r**ir**t issu*, w*i** *orr*l*t*s wit* *ut**nti**tion *low *ontrol. T** r*l**s* not*s sp**i*i**lly m*ntion t*is PR *ix** t** u