Attack Chain

1. Attacker gains authenticated access to an OpenPanel instance with 'project write' permissions.
2. Attacker navigates to the webhook template management interface.
3. Attacker crafts a malicious JavaScript payload utilizing computed property notation (e.g., [constructor]).
4. Attacker saves the payload into a webhook template.
5. The OpenPanel js-runtime triggers the validator to process the template.
6. The validator fails to block the access to the Function constructor chain.
7. The runtime executes the attacker-controlled code within the worker process.

Impact

Successful exploitation grants an attacker arbitrary code execution capabilities within the worker process of the OpenPanel js-runtime. This could lead to sensitive data exfiltration, lateral movement within the infrastructure, or service disruption. Given the high CVSS score of 9.9, the risk to organizations utilizing OpenPanel for webhook management is critical, as it bypasses intended security boundaries.

Recommendation

Prioritized actions for security teams:

• Identify and audit all existing webhook templates created or modified by non-administrative users.
• Patch OpenPanel js-runtime to a version beyond commit bad75bdd immediately once a fix is provided by the vendor.
• Implement strict ingress filtering for the OpenPanel management interface to limit potential unauthorized project-level access.
• Review worker process permissions to enforce the principle of least privilege, minimizing the potential impact of an arbitrary code execution event.