CRITICAL

CVE-2024-51378

Cyberpanel Cyberpanel 2024-10-29 CVSS v3.1

CVSS

9.8

KEV

Description

getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.

Summary dbcve.org

CyberPanel before 1c0c6cb contains an authentication bypass vulnerability in the getresetstatus endpoint. The secMiddleware only enforces authentication on POST requests, allowing attackers to use GET requests to /dns/getresetstatus or /ftp/getresetstatus without authentication. Combined with shell metacharacters in the statusfile parameter, this enables remote command execution. This was actively exploited in the wild in October 2024.

Mitigation

Upgrade CyberPanel to version 1c0c6cb or later. If immediate patching is not possible, implement web application firewall rules to block shell metacharacters in the statusfile parameter and ensure all sensitive endpoints require authentication regardless of HTTP method.

Proof of Concept

Patch Commit

Weakness (CWE)

CWE-78 OS Command Injection

EPSS Score

94.67%

Probability of exploitation in next 30 days

99.9th percentile

References

https://cwe.mitre.org/data/definitions/420.html Not Applicable https://cwe.mitre.org/data/definitions/78.html Not Applicable https://cyberpanel.net/KnowledgeBase/home/change-logs/ Release Notes https://cyberpanel.net/blog/detials-and-fix-of-recent-security-issue-and-patch-of-cyberpanel Product https://github.com/usmannasir/cyberpanel/commit/1c0c6cbcf71abe573da0b5fddfb9603e7477f683 Patch https://refr4g.github.io/posts/cyberpanel-command-injection-vulnerability/ Exploit https://www.bleepingcomputer.com/news/security/massive-psaux-ransomware-attack-targets-22-000-cyberpanel-instances/ Exploit, Press/Media Coverage https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-51378 US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE