Portainer Unauthenticated Restore Endpoint Vulnerability in Uninitialized Instances

Portainer version details are not specified in the GitHub Security Advisory database, but a high-severity vulnerability has been disclosed affecting its unauthenticated restore endpoint. The `/api/restore` endpoint, designed for restoring backups before the creation of an admin account, remains accessible during a five-minute initialization window each time Portainer starts. During this window, an attacker with network access to an uninitialized Portainer instance can exploit the endpoint to replace the database with a crafted archive containing attacker-controlled credentials. Alternatively, the attacker can use the `/api/users/admin/init` endpoint to directly create the first administrator account. Once the five-minute window expires, Portainer locks its API until the instance is restarted, at which point the setup window reopens.

Operators should carefully evaluate the exposure of their Portainer instances during initialization. Any instance exposed to untrusted networks during the setup window is vulnerable to this attack. It is crucial to ensure that new or restarted instances are isolated from external access until initialization is complete. Additionally, operators may want to review their deployment processes to minimize the risk of inadvertently exposing uninitialized instances. This vulnerability highlights the importance of securing setup endpoints, a pattern seen across multiple projects where initial configuration steps can create attack vectors.