1Panel Cross-Site Request Forgery Vulnerability in Panel Name Management

A cross-site request forgery (CSRF) vulnerability has been identified in 1Panel versions 1.10.33 prior to 2.0.15. The issue resides within the panel name management feature, where the endpoint lacks proper CSRF protections, such as anti-CSRF tokens or validation of the Origin/Referer headers. This vulnerability allows an attacker to create a malicious webpage that, when visited by an authenticated user, can change the user's panel name to an arbitrary value without their consent.

Impact

Exploitation of this vulnerability allows for unauthorized modification of a user's panel name, potentially leading to confusion or misuse of the panel management features.