CyberRota Analysis
AI-GeneratedDocker installations using Pelican Panel versions prior to 1.0.0-beta35 are vulnerable due to inadequate server-side authorization checks, allowing attackers with startup.read permissions to manipulate Livewire state updates. This could lead to unauthorized modifications of startup commands, Docker images, and environment variables, enabling the execution of arbitrary commands within the container. Organizations utilizing affected versions should prioritize patching to mitigate the risk of potential container compromise.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through disabled form controls rather than server-side authorization checks. Attackers with startup.read permission can craft Livewire state updates to invoke afterStateUpdated callbacks and modify startup commands, docker images, and variables to execute arbitrary commands in the container.