PT-2024-9377 · Unknown · Cyberpanel

Published 2024-10-23 · Updated 2026-02-01 · CVE-2024-51567

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: CyberPanel versions through 2.3.6 and (unpatched) 2.3.7

Description: The issue is related to the upgrademysqlstatus function in CyberPanel, which has inadequate authentication procedures. This allows a remote attacker to bypass authentication and execute arbitrary commands via the /dataBases/upgrademysqlstatus endpoint by using shell metacharacters in the statusfile property. The vulnerability has been exploited in the wild in October 2024 by PSAUX.

Recommendations: For versions through 2.3.6 and (unpatched) 2.3.7, consider disabling the upgrademysqlstatus function in databases/views.py to prevent exploitation until a patch is available. Restrict access to the /dataBases/upgrademysqlstatus endpoint to minimize the risk of exploitation. Avoid using the statusfile property in the affected endpoint until the issue is resolved.

Exploit

Fix

Missing Authentication

Incorrect Default Permissions

Weakness Enumeration

CWE-306

CWE-276

CWE-267

Related Identifiers

BDU:2024-11067

CVE-2024-51567

Affected Products

Cyberpanel

References · 40

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/cyberpanel_preauth_rce_multi_cve.rb · Exploit
• 🔥 https://github.com/XiaomingX/cve-2024-51567-poc · Exploit
• 🔥 https://github.com/ajayalf/CVE-2024-51567 · Exploit
• 🔥 https://dreyand.rs/code/review/2024/10/27/what-are-my-options-cyberpanel-v236-pre-auth-rce · Exploit
• https://github.com/usmannasir/cyberpanel/commit/5b08cd6d53f4dbc2107ad9f555122ce8b0996515 · Patch
• https://cyberpanel.net/blog/detials-and-fix-of-recent-security-issue-and-patch-of-cyberpanel · Security Note
• https://bdu.fstec.ru/vul/2024-11067 · Security Note
• https://osv.dev/vulnerability/CVE-2024-51567 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-51567 · Security Note
• https://twitter.com/seclink/status/1861234432683974866 · Twitter Post
• https://bleepingcomputer.com/news/security/massive-psaux-ransomware-attack-targets-22-000-cyberpanel-instances · Note
• https://twitter.com/Loginsoft_Inc/status/1854939264481739069 · Twitter Post
• https://t.me/pentestingnews/52770 · Telegram Post
• https://twitter.com/UjlakiMarci/status/1854565052403126485 · Twitter Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-51567 · Note