Listen to this Post
The vulnerability exists within the `/api/login` endpoint of the 1Panel management platform. The endpoint’s authentication logic accepts a client-supplied JSON parameter named ignoreCaptcha. This boolean value is read directly from the HTTP request body into the server-side `req.IgnoreCaptcha` variable without any validation, binding to a user session, or privilege checks. The backend code then uses this untrusted value in a conditional statement: if `!req.IgnoreCaptcha` is false, it skips the CAPTCHA verification routine entirely. Therefore, an unauthenticated attacker can simply send a login request with `”ignoreCaptcha”: true` in the POST data. This causes the server to bypass the `captcha.VerifyCode` check, allowing the attacker to proceed to password validation without solving a CAPTCHA. This design flaw makes the anti-automation control entirely client-controlled, enabling brute-force attacks on login credentials.
Platform: 1Panel
Version: <= v1.8.0
Vulnerability : Authentication Bypass
Severity: Critical
date: 2024-01-25
Prediction: 2024-01-31
What Undercode Say:
curl -X POST 'http://<target>/api/login' -H 'Content-Type: application/json' -d '{"username":"admin","password":"guess","ignoreCaptcha":true}'
How Exploit:
- Craft POST request
- Set ignoreCaptcha true
- Bypass CAPTCHA check
- Proceed to password brute-force
Protection from this CVE
- Update to patched version
- Validate server-side flags
- Remove client-controlled security parameters
- Implement mandatory CAPTCHA
Impact:
- Unauthorized access
- Account takeover
- Brute-force enabling
- System compromise
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
