CVE-2025-34429
📋 TL;DR
This CSRF vulnerability in 1Panel allows attackers to change the web service port when authenticated users visit malicious pages. Affected users are those running 1Panel versions 1.10.33 through 2.0.15 with web access, potentially causing service disruption or exposure on attacker-chosen ports.
💻 Affected Systems
- 1Panel
📦 What is this software?
1panel by Fit2cloud
⚠️ Risk & Real-World Impact
Worst Case
Complete loss of web management access, service disruption, and potential exposure on insecure ports leading to further attacks.
Likely Case
Service disruption requiring manual port restoration and temporary loss of management access.
If Mitigated
No impact if CSRF protections are implemented or if the service is not internet-facing.
🎯 Exploit Status
Exploitation requires user authentication but is technically simple via crafted HTML pages.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.16
Vendor Advisory: https://github.com/1Panel-dev/1Panel/releases
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Update to version 2.0.16 or later via 1Panel's built-in update mechanism or manual installation. 3. Restart the 1Panel service.
🔧 Temporary Workarounds
Implement CSRF Protection Proxy
linuxPlace a reverse proxy with CSRF token validation in front of 1Panel
# Configure nginx with CSRF protection
# Add 'proxy_set_header X-CSRF-Token $http_x_csrf_token;' to location block
Restrict Network Access
linuxLimit 1Panel web interface access to trusted IPs only
# Use firewall rules: ufw allow from TRUSTED_IP to any port PANEL_PORT
# Or configure web server access controls
🧯 If You Can't Patch
- Implement strict network segmentation and limit 1Panel access to management networks only.
- Deploy a WAF or reverse proxy with CSRF protection between users and 1Panel.
🔍 How to Verify
Check if Vulnerable:
Check 1Panel version via web interface dashboard or run '1panel version' command. If version is between 1.10.33 and 2.0.15 inclusive, system is vulnerable.Check Version:
1panel versionVerify Fix Applied:
Verify version is 2.0.16 or later and test port change functionality with CSRF token validation.📡 Detection & Monitoring
Log Indicators:
- Unexpected port configuration changes in 1Panel logs
- Web requests to port-change endpoint without CSRF tokens
Network Indicators:
- Unusual port scanning activity targeting non-standard ports
- HTTP requests from unexpected origins to management interface
SIEM Query:
source="1panel.log" AND "port-change" AND NOT csrf_token=*