CRITICAL

CVE-2022-44877

Control-webpanel Webpanel 2023-01-05 CVSS v3.1

CVSS

9.8

KEV

Description

login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the login parameter.

Summary dbcve.org

CWP (Control Web Panel) 7 prior to version 0.9.8.1147 contains an unauthenticated OS command injection vulnerability in login/index.php. The 'login' parameter is passed unsanitized to a shell context, allowing a remote attacker with no credentials to inject shell metacharacters and execute arbitrary OS commands on the underlying host.

Mitigation

Upgrade CWP 7 to version 0.9.8.1147 or later. As an interim compensating control, restrict network access to the CWP login endpoint (e.g., firewall/allow-list on port 2030/2086/2087) and deploy WAF rules that block shell metacharacters in the login POST body until the patch is applied.

Proof of Concept

Weakness (CWE)

CWE-78 OS Command Injection

EPSS Score

100%

Probability of exploitation in next 30 days

100th percentile

References

http://packetstormsecurity.com/files/170388/Control-Web-Panel-7-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry http://packetstormsecurity.com/files/170820/Control-Web-Panel-Unauthenticated-Remote-Command-Execution.html Exploit, Third Party Advisory, VDB Entry http://packetstormsecurity.com/files/171725/Control-Web-Panel-7-CWP7-0.9.8.1147-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry http://seclists.org/fulldisclosure/2023/Jan/1 Exploit, Mailing List, Third Party Advisory https://gist.github.com/numanturle/c1e82c47f4cba24cff214e904c227386 Exploit, Third Party Advisory https://www.youtube.com/watch?v=kiLfSvc1SYY Exploit, Third Party Advisory https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-44877 US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE