CyberPanel vulnerability allows remote attackers to bypass authentication and execute arbitrary commands
CVE-2024-51378

10CRITICAL

Key Information:

Vendor: CyberPanel
Status: Cyberpanel
Vendor: CVE Published:; 29 October 2024

Badges

💰 Ransomware👾 Exploit Exists🟡 Public PoC🟣 EPSS 93%🦅 CISA Reported📰 News Worthy

Summary

A critical vulnerability has been identified in CyberPanel, specifically in the getresetstatus function located in the dns/views.py and ftp/views.py files. This vulnerability enables remote attackers to bypass authentication mechanisms and execute arbitrary commands by exploiting the /dns/getresetstatus and /ftp/getresetstatus endpoints. The vulnerability arises due to inadequate security checks for GET requests, where necessary middleware is applied solely to POST requests. Attackers can utilize shell metacharacters in the statusfile property to trigger this flaw. Exploitation of this vulnerability has been confirmed in the wild, raising significant security concerns for unpatched versions of CyberPanel, particularly versions prior to 1c0c6cb and until 2.3.6.

CISA Reported

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed as being exploited and is known by the CISA as enabling ransomware campaigns.

The CISA's recommendation is: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-51378
Created by refr4g