Listen to this Post
How the CVE Works
The vulnerability arises due to inconsistent path handling in RatPanel’s middleware. When a double slash (//api/ws/ssh) is used in the URL, `r.URL.Path` retains the double slash, while the Chi router’s `CleanPath` middleware normalizes it to /api/ws/ssh. The `must_login` middleware checks `r.URL.Path` against a whitelist but fails to match due to the extra slash, allowing unauthorized access to restricted APIs like `/api/ws/exec` and /api/ws/ssh. Attackers can exploit this by first activating a session via the backend login page, then using websocket tools (e.g., _wsdump.py) to execute commands.
DailyCVE Form
Platform: RatPanel
Version: v2.3.19-v2.5.5
Vulnerability: Auth Bypass → RCE
Severity: Moderate
Date: 2023-XX-XX
Prediction: Patch by 2023-XX-XX
What Undercode Say
Check RatPanel version curl -I http://target:port/login Exploit with websocket python _wsdump.py wss://target:port//api/ws/exec --headers "Cookie: session=XXXXXX" -n
How Exploit
1. Identify RatPanel backend URL.
2. Activate session via `/login`.
3. Send crafted `//api/ws/exec` request.
4. Execute arbitrary commands via websocket.
Protection from this CVE
- Update to patched version.
- Restrict panel access via firewall.
- Use strong, unique login paths.
Impact
- Unauthorized command execution.
- Host takeover (v2.5.1-v2.5.5).
- Compromised managed systems.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
