Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-39907

CVE-2024-39907: 1Panel has an SQL injection issue related to the orderBy clause

9.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2024-39907
GHSA ID
GHSA-5grx-v727-qmq6
EPSS Score
0.98373%
CWE
CWE-89
Published
7/18/2024
Updated
8/3/2024
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
github.com/1Panel-dev/1Panelgo< 1.10.12-tls1.10.12-tls

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from unvalidated 'orderBy' parameters in multiple DTOs being passed to GORM's Order() method. The patch added 'oneof' validation to OrderBy fields, indicating previous lack of input filtering. Functions handling these parameters (e.g., cronjob API handlers and service methods) directly used user input in SQL ORDER BY clauses through GORM, enabling column count enumeration and SQL injection. The PoC demonstrates injection via orderBy=3, which would map to unvalidated column references in vulnerable versions.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Summ*ry T**r* *r* m*ny sql inj**tions in t** proj**t, *n* som* o* t**m *r* not w*ll *ilt*r**, l***in* to *r*itr*ry *il* writ*s, *n* ultim*t*ly l***in* to R**s. T** proo* is *s *ollows ### **t*ils （on* o* t**m ） <im* wi*t*="***" *lt="im***" sr*="

Reasoning

T** vuln*r**ility st*ms *rom unv*li**t** 'or**r*y' p*r*m*t*rs in multipl* *TOs **in* p*ss** to *ORM's `Or**r()` m*t*o*. T** p*t** ***** 'on*o*' v*li**tion to Or**r*y *i*l*s, in*i**tin* pr*vious l**k o* input *ilt*rin*. *un*tions **n*lin* t**s* p*r*m*