CVE-2024-51567 CyberPanel Incorrect Default Permissions
Remote attackers can bypass authentication and execute arbitrary commands in CyberPanel by exploiting a middleware flaw and shell metacharacters.
- Exploited in the wild
- Since 7 Nov 2024
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-51567?
CVE-2024-51567 is a critical authentication bypass vulnerability in n/a, published on 29 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.
Weakness: CWE-306
Which versions are affected by CVE-2024-51567?
It affects 1 product.
Products include Cyberpanel Cyberpanel.
How do I fix CVE-2024-51567?
No fix has been published for CVE-2024-51567 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 28 Nov 2024.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-51567 being exploited?
Yes. Attackers have exploited CVE-2024-51567 in the wild since at least 7 Nov 2024, including in ransomware campaigns.
Public exploit code: 1 Metasploit module, 1 Nuclei template and 3 proofs of concept on GitHub.
Other vulnerabilities in n/a
Sources
Also known as GHSA-w6g2-qqv5-83qj.