Paper/Archive/CVE-2024-51378

CVE-2024-51378

cyberpanel cyberpanel — CyberPanel Incorrect Default Permissions Vulnerability

KEV · due 25 Dec ransomware use EPSS 95%public exploit SSVC act CVSS 10.0

100

CVSS 10.0 (CNA)10.0 / 10 × 3030.0 In CISA KEV+3030.0 EPSS percentile 99.9.999 × 2020.0 Exploit: SSVC active+1010.0 SSVC exploitation: active+1010.0

Description · from the CVE record

getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

cyberpanel< 2.3.92.3.9CISA-ADP

Scores by source

mitre (CNA)10.0CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N

CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refcwe.mitre.org/data/definitions/78.html refgithub.com/usmannasir/cyberpanel/commit/1c0c6cbcf71abe573da0b5fddfb9603e7477f683 refrefr4g.github.io/posts/cyberpanel-command-injection-vulnerability refcyberpanel.net/KnowledgeBase/home/change-logs refcwe.mitre.org/data/definitions/420.html refcyberpanel.net/blog/detials-and-fix-of-recent-security-issue-and-patch-of-cyberpanel refbleepingcomputer.com/news/security/massive-psaux-ransomware-attack-targets-22-000-cyberpanel-instances refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-51378 kevcisa.gov/known-exploited-vulnerabilities-catalog