CVE-2024-51378criticalunder attackransomwareCWE-78

CVE-2024-51378

Published · Updated

Follow this CVE+ Monitor CyberPanel

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 10epss 95%
from disclosure to weaponsame day
Published on NVDOct 29
1st PoCOct 29
metasploitOct 27
CISA KEV+36d
Action required by CISAfederal deadline: 2024-12-25

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

CyberPanel has a critical flaw where attackers can skip login checks and run any system commands on the server by sending specially crafted requests to specific URLs, exploiting a gap in security filters.

Technical detail

The getresetstatus endpoints in dns/views.py and ftp/views.py fail to enforce authentication on GET requests due to middleware protection limited to POST, allowing unauthenticated command injection via shell metacharacters in the statusfile parameter; OS command execution occurs without prior authentication or authorization checks.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.
CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.