Login Request a demo
Critical severity · published Oct 29, 2024
CVE-2024-51378
CyberPanel Incorrect Default Permissions Vulnerability
RansomwareIn wildKEV
9.8
CVSS
94.7%
EPSS
Yes
On KEV
Description
getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)94.7% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Dec 4, 2024
Federal remediation dueDec 25, 2024
Ransomware campaign useKnown
Affected products
Which versions
CY
Cyberpanel · Cyberpanel
before 2.3.8 · source: NVD, CISA, KEV
Affected product
CY
Cyberpanel
Cyberpanel
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-51378
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-51378
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
cwe.mitre.org
https://cwe.mitre.org/data/definitions/78.html
github.com
https://github.com/usmannasir/cyberpanel/commit/1c0c6cbcf71abe573da0b5fddfb9603e7477f683
refr4g.github.io
https://refr4g.github.io/posts/cyberpanel-command-injection-vulnerability/
cyberpanel.net
https://cyberpanel.net/KnowledgeBase/home/change-logs/
cwe.mitre.org
https://cwe.mitre.org/data/definitions/420.html
cyberpanel.net
https://cyberpanel.net/blog/detials-and-fix-of-recent-security-issue-and-patch-of-cyberpanel
More from Cyberpanel
9.8
CVE-2024-51567
CyberPanel Incorrect Default Permissions Vulnerability
9.8
CVE-2024-51568
CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner() sink
9.1
CVE-2026-41473
CyberPanel < 2.4.5 Unauthenticated API Access via AI Scanner Endpoints
8.8
CVE-2021-47949
CyberPanel 2.1 Authenticated Remote Code Execution via Symlink Attack
8.8
CVE-2024-53376
CyberPanel before 2.3.8 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the phpSelection field to the websites/submitWebsiteCreation…