CVE-2025-34410: Fit2cloud 1Panel CSRF Vulnerability

CVE-2025-34410 Overview

CVE-2025-34410 is a Cross-Site Request Forgery (CSRF) vulnerability in 1Panel, a popular Linux server management panel developed by Fit2cloud. The flaw affects 1Panel versions 1.10.33 through 2.0.15 and resides in the Change Username functionality at /settings/panel. The endpoint lacks anti-CSRF tokens and Origin/Referer validation. An attacker can host a malicious webpage that triggers a username-change request when an authenticated victim visits it. The browser submits valid session cookies, the change succeeds, and the victim is logged out and locked out of the account, producing a denial-of-service condition.

Critical Impact

A single visit to an attacker-controlled page by an authenticated 1Panel administrator can silently rename the account, lock the legitimate user out, and disrupt server administration.

Affected Products

• Fit2cloud 1Panel version 1.10.33
• Fit2cloud 1Panel versions 1.10.34 through 2.0.14
• Fit2cloud 1Panel version 2.0.15

Discovery Timeline

• 2025-12-10 - CVE-2025-34410 published to NVD
• 2025-12-23 - Last updated in NVD database

Technical Details for CVE-2025-34410

Vulnerability Analysis

The vulnerability is classified as Cross-Site Request Forgery [CWE-352]. The Change Username endpoint exposed under /settings/panel accepts state-changing requests without verifying request origin. 1Panel relies on session cookies for authentication but does not pair them with anti-CSRF tokens, SameSite enforcement, or Origin/Referer header validation.

When a logged-in administrator browses to an attacker-controlled site, the attacker's page issues a cross-origin request to the 1Panel instance. The browser automatically attaches the administrator's session cookie, and the server processes the username change as if the administrator initiated it. The username field is a unique authentication identifier, so changing it invalidates the victim's existing credentials.

Root Cause

The root cause is the absence of CSRF mitigations on a sensitive state-changing endpoint. The application does not require a synchronizer token, does not verify the Origin or Referer header, and does not restrict the operation to same-origin requests. Authentication relies solely on ambient session cookies, which browsers transmit on cross-site requests by default when SameSite is not strictly enforced.

Attack Vector

Exploitation requires a victim with an active 1Panel session to visit an attacker-controlled page or click a crafted link. The attacker's page submits a forged POST request to the victim's 1Panel instance targeting the username-change endpoint. The server accepts the request, updates the username, and terminates the session. The victim cannot authenticate with the prior username, resulting in account lockout. No interaction with the 1Panel UI beyond the initial session is required from the victim. See the VulnCheck Advisory on 1Panel CSRF for the full technical write-up.

Detection Methods for CVE-2025-34410

Indicators of Compromise

• Unexpected username changes recorded in 1Panel audit or settings logs.
• Authentication failures by legitimate administrators immediately following a successful username update event.
• HTTP POST requests to /settings/panel containing a Referer or Origin header pointing to an external domain.

Detection Strategies

• Inspect reverse proxy and 1Panel access logs for requests to the username-change endpoint where the Origin or Referer header does not match the panel's own hostname.
• Correlate username modification events with subsequent failed logins from the same source IP or user agent.
• Alert on settings endpoint activity occurring outside of normal administrator workflows or maintenance windows.

Monitoring Recommendations

• Forward 1Panel application and web server logs to a centralized SIEM for cross-correlation.
• Monitor administrator session activity for anomalous state changes to authentication-related fields.
• Track lockout and password-reset events on 1Panel hosts and trigger investigations on clustered occurrences.

How to Mitigate CVE-2025-34410

Immediate Actions Required

• Upgrade 1Panel to a version released after 2.0.15 once the vendor publishes a fix. Review the GitHub 1Panel Release Notes for the latest patched build.
• Restrict access to the 1Panel management interface to trusted management networks or VPN-only access.
• Instruct administrators to log out of 1Panel when not actively managing the server and avoid browsing untrusted sites in the same browser session.

Patch Information

At the time of CVE publication, the advisory identifies versions 1.10.33 through 2.0.15 as vulnerable. Administrators should consult the 1Panel Official Website and the project's GitHub releases page for the fixed version and apply it as soon as it becomes available.

Workarounds

• Place 1Panel behind a reverse proxy that enforces strict Origin and Referer header validation on POST requests to /settings/panel.
• Configure session cookies with SameSite=Strict at the proxy layer where feasible to block cross-site cookie transmission.
• Use a dedicated browser profile or isolated browser for 1Panel administration to limit cross-site request exposure.

# Example NGINX snippet to block cross-origin POSTs to the settings endpoint
location /settings/panel {
    if ($http_origin !~* "^https://panel\.example\.com$") {
        return 403;
    }
    proxy_pass http://127.0.0.1:8080;
}