CVE-2024-2352 | 1Panel up to 1.10.1-lts swap baseApi.UpdateDeviceSwap Path command injection (ID 4131)

A vulnerability, which was classified as critical, has been found in 1Panel up to 1.10.1-lts. Affected by this issue is the function baseApi.UpdateDeviceSwap of the file /api/v1/toolbox/device/update/swap. The manipulation of the argument Path with the input 123123123nopen -a Calculator leads to command injection.

This vulnerability is handled as CVE-2024-2352. The attack may be launched remotely. Furthermore, there is an exploit available.

It is recommended to apply a patch to fix this issue.