CVE-2025-34430
📋 TL;DR
This CSRF vulnerability in 1Panel allows attackers to change a victim's panel name without consent by tricking them into visiting a malicious webpage while authenticated. It affects all users running vulnerable versions of 1Panel. The attack requires the victim to be logged into their 1Panel instance.
💻 Affected Systems
- 1Panel
📦 What is this software?
1panel by Fit2cloud
⚠️ Risk & Real-World Impact
Worst Case
An attacker could change panel names to misleading or offensive values, causing confusion, operational disruption, or reputational damage if panel names are visible to others.
Likely Case
Most attacks would involve changing panel names to annoying or confusing values, causing minor disruption to legitimate users.
If Mitigated
With proper CSRF protections implemented, no unauthorized panel name changes would be possible.
🎯 Exploit Status
Exploitation requires the victim to be authenticated to their 1Panel instance and visit a malicious webpage. The attack leverages standard CSRF techniques without requiring special conditions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.16 or later
Vendor Advisory: https://github.com/1Panel-dev/1Panel/releases
Restart Required: Yes
Instructions:
1. Backup your 1Panel configuration. 2. Update to version 2.0.16 or later using the 1Panel update functionality or manual installation. 3. Restart the 1Panel service.
🔧 Temporary Workarounds
Implement CSRF Protection Proxy
linuxDeploy a reverse proxy with CSRF protection headers and validation
# Configure nginx with CSRF protection
add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;
add_header Referrer-Policy strict-origin-when-cross-origin;
Browser Security Extensions
allUse browser extensions that block CSRF attacks
🧯 If You Can't Patch
- Restrict access to 1Panel to trusted networks only using firewall rules
- Implement strict SameSite cookie policies and use separate browser sessions for administrative tasks
🔍 How to Verify
Check if Vulnerable:
Check if your 1Panel version is between 1.10.33 and 2.0.15 inclusiveCheck Version:
1pctl versionVerify Fix Applied:
Verify version is 2.0.16 or later and test panel name change functionality with CSRF testing tools📡 Detection & Monitoring
Log Indicators:
- Unexpected panel name change events
- Multiple panel name modifications from same user in short time
Network Indicators:
- HTTP POST requests to panel name endpoint without proper Referer/Origin headers
- Cross-origin requests to 1Panel endpoints
SIEM Query:
source="1panel" action="modify_panel_name" | stats count by user, src_ip