CVE-2024-51378

CVSS 10 CRITICALEPSS 94.9%● KEVCWE-78

Vexday Risk Score

100Fix now

SSVC decision (CISA)

Act

Exploitation + impact → act immediately

CVSS 10EPSS 94.9%KEV simPoC públicaPatch —

Lifecycle

29 Oct 2024Published on NVD

29 Oct 2024Public PoC

04 Dec 2024Active exploitation (CISA KEV)

Recommendation: Patch as soon as possible — active exploitation confirmed.

In short

CyberPanel has a critical flaw where attackers can skip login checks and run any system commands on the server by sending specially crafted requests to specific URLs, exploiting a gap in security filters.

Technical detail

The getresetstatus endpoints in dns/views.py and ftp/views.py fail to enforce authentication on GET requests due to middleware protection limited to POST, allowing unauthenticated command injection via shell metacharacters in the statusfile parameter; OS command execution occurs without prior authentication or authorization checks.

Summary generated and translated by AI from the official description.

getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.

CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N

Affected products

n/a · n/a

public PoCs found — 4

githubgithub.com/refr4g/CVE-2024-51378★ 22 githubgithub.com/qnole000/CVE-2024-51378★ 0 githubgithub.com/rimbadirgantara/CVE-2024-51378★ 0 exploitdbwww.exploit-db.com/exploits/52172unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://cwe.mitre.org/data/definitions/420.html https://cwe.mitre.org/data/definitions/78.html https://cyberpanel.net/blog/detials-and-fix-of-recent-security-issue-and-patch-of-cyberpanel https://cyberpanel.net/KnowledgeBase/home/change-logs/https://github.com/usmannasir/cyberpanel/commit/1c0c6cbcf71abe573da0b5fddfb9603e7477f683 https://refr4g.github.io/posts/cyberpanel-command-injection-vulnerability/https://www.bleepingcomputer.com/news/security/massive-psaux-ransomware-attack-targets-22-000-cyberpanel-instances/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-51378