PT-2024-7642 · Unknown · Cyberpanel

Refr4G · Published 2024-10-29 · Updated 2025-06-13 · CVE-2024-51378

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N

Name of the Vulnerable Software and Affected Versions CyberPanel versions prior to 1c0c6cb CyberPanel versions through 2.3.6 CyberPanel version 2.3.7

Description The issue is related to incorrect default permissions in CyberPanel, allowing remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware and using shell metacharacters in the statusfile property. This vulnerability has been exploited in the wild, with over 880K services found to be vulnerable. It is estimated that over 22k servers have been targeted in a massive ransomware attack.

Recommendations For CyberPanel versions prior to 1c0c6cb, update to a version after 1c0c6cb to resolve the issue. For CyberPanel versions through 2.3.6, update to a version after 2.3.6 to resolve the issue. For CyberPanel version 2.3.7, apply the necessary patches or updates to resolve the issue. As a temporary workaround, consider disabling the getresetstatus function in dns/views.py and ftp/views.py until a patch is available. Restrict access to the vulnerable endpoints /dns/getresetstatus and /ftp/getresetstatus to minimize the risk of exploitation. Avoid using the statusfile property in the affected API endpoints until the issue is resolved.

Exploit

Fix

RCE

Incorrect Default Permissions

OS Command Injection

Command Injection

Weakness Enumeration

CWE-276

CWE-78

CWE-77

Related Identifiers

BDU:2024-09083

CVE-2024-51378

Affected Products

Cyberpanel

References · 61

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/cyberpanel_preauth_rce_multi_cve.rb · Exploit
• 🔥 https://github.com/refr4g/CVE-2024-51378 · Exploit
• 🔥 https://refr4g.github.io/posts/cyberpanel-command-injection-vulnerability · Exploit
• 🔥 https://exploit-db.com/exploits/52172 · Exploit
• 🔥 https://bleepingcomputer.com/news/security/massive-psaux-ransomware-attack-targets-22-000-cyberpanel-instances · Exploit
• https://github.com/usmannasir/cyberpanel/commit/1c0c6cbcf71abe573da0b5fddfb9603e7477f683 · Patch
• https://cyberpanel.net/KnowledgeBase/home/change-logs · Security Note
• https://bdu.fstec.ru/vul/2024-09083 · Security Note
• https://osv.dev/vulnerability/CVE-2024-51378 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-51378 · Security Note
• https://twitter.com/pravin_karthik/status/1864659976146571302 · Twitter Post
• https://twitter.com/fridaysecurity/status/1864497879047369110 · Twitter Post
• https://twitter.com/akaclandestine/status/1865786033788653601 · Twitter Post
• https://cyberpanel.net/blog/detials-and-fix-of-recent-security-issue-and-patch-of-cyberpanel · Note
• https://twitter.com/RakeshKrish12/status/1859476613962006541 · Twitter Post