CVE-2024-54679

Executive Summary

CVE-2024-54679 is a missing authorization vulnerability in CyberPanel (Cyber Panel) versions prior to commit 6778ad1. The flaw allows an authenticated user without the FilemanagerAdmin capability to perform restartMySQL actions. This is a privilege escalation issue within the panel’s role-based access control (RBAC) system, enabling lower-privileged users to restart the MySQL service, potentially causing denial of service or disrupting database operations. The CVSS score is 4.3 (Medium), and no public exploit code or proof-of-concept is currently available. The vendor has not released an official patch version, but the fix is available in the source repository.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects the CyberPanel web hosting control panel, which is typically deployed as a standalone application.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – an authenticated user account is needed.
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L) – the attacker can restart MySQL, but not modify data directly.
• Availability Impact: None (A:N) – restarting MySQL causes temporary unavailability, but the CVSS v3.1 scoring does not consider temporary service disruption as a direct availability impact in this context.

Threat Level: Medium. The vulnerability requires authentication but allows a low-privileged user to disrupt a critical service (MySQL). This could be used in combination with other attacks to cause prolonged downtime or data corruption.

Deep Dive & Mechanics

The vulnerability resides in the CyberPanel backend code that handles the restartMySQL action. In affected versions, the code does not verify that the requesting user possesses the FilemanagerAdmin capability before executing the restart. The intended RBAC model should restrict such administrative actions to users with the FilemanagerAdmin role.

The flaw is a classic case of Missing Authorization (CWE-862). The application fails to enforce a capability check on the server side, allowing any authenticated user to trigger the MySQL restart endpoint. The attack is performed via a crafted HTTP request to the CyberPanel API or web interface.

The impact is limited to service disruption (denial of service) of the MySQL database. An attacker cannot read or modify database contents directly through this vulnerability, but repeated restarts could lead to data corruption or loss if transactions are interrupted.

Vulnerable vs. Patched Code

Vulnerable Code (before 6778ad1): The vulnerable code likely lacks a capability check in the function handling the restart request. For example:

// Vulnerable: No capability check
public function restartMySQL() {
    // Execute restart command
    exec('systemctl restart mysql');
    return 'MySQL restarted';
}

Patched Code (after 6778ad1): The fix adds a capability check to ensure only users with FilemanagerAdmin can execute the action.

// Patched: Capability check added
public function restartMySQL() {
    if (!$this->user->hasCapability('FilemanagerAdmin')) {
        throw new Exception('Insufficient permissions');
    }
    exec('systemctl restart mysql');
    return 'MySQL restarted';
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A valid authenticated session (cookie or API token) for a CyberPanel user without FilemanagerAdmin capability.
• Network access to the CyberPanel web interface (typically port 8090).

Exploitation Steps:

1. Log in to CyberPanel as a low-privileged user.
2. Identify the endpoint for restarting MySQL. This is likely a POST request to /api/restartMySQL or similar.
3. Send a crafted request:

POST /api/restartMySQL HTTP/1.1
Host: target-cyberpanel:8090
Cookie: PHPSESSID=valid_session_id
Content-Type: application/x-www-form-urlencoded
Content-Length: 0

4. The server will execute the restart command without checking permissions.

Expected Outcome: The MySQL service restarts, causing a brief outage for all websites hosted on the panel.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual API calls to /restartMySQL or similar endpoints from non-admin users.
• Look for rapid, repeated restart attempts (potential DoS).
• Correlate with authentication logs to identify the user account.

Defense:

• Apply the patch from commit 6778ad1 immediately.
• Implement additional logging for all administrative actions.
• Use a Web Application Firewall (WAF) to block requests to sensitive endpoints from low-privileged sessions.
• Restrict network access to the CyberPanel interface to trusted IPs only.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /api/restartMySQL or similar endpoints.
  • Repeated 200 OK responses to such requests from non-admin users.
• System IOCs:
  • Unexpected MySQL service restarts in system logs (/var/log/mysql/error.log, journalctl -u mysql).
  • Audit logs showing execution of systemctl restart mysql or service mysql restart by the web server user (e.g., www-data).
• File IOCs:
  • Modified CyberPanel source files (if attacker attempts to patch the vulnerability themselves).

Detection Engineering

YARA Rule

rule CVE_2024_54679_CyberPanel_Missing_Auth {
    meta:
        description = "Detects missing authorization in CyberPanel restartMySQL action"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-54679"
    strings:
        $vuln_func = "restartMySQL" nocase
        $missing_check = "hasCapability" nocase
    condition:
        $vuln_func and not $missing_check
}

Sigma Rule

title: CyberPanel Missing Authorization for MySQL Restart
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to restart MySQL via CyberPanel without proper authorization
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/restartMySQL'
    condition: selection
falsepositives:
    - Legitimate admin actions (if patched)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-54679 CyberPanel restartMySQL Missing Auth"; flow:to_server,established; content:"POST"; http_method; content:"/api/restartMySQL"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply the Patch: Update CyberPanel to a version that includes commit 6778ad1 or later. If using a Git-based deployment, pull the latest changes.
2. Manual Fix: If patching is not possible, modify the source code to add a capability check for FilemanagerAdmin before the restartMySQL action.
3. Restrict Access: Limit access to the CyberPanel web interface to trusted IP addresses using firewall rules.
4. Review User Roles: Audit all user accounts and ensure only trusted administrators have elevated privileges.

Long-Term Measures:

• Implement a Web Application Firewall (WAF) to block unauthorized API calls.
• Enable detailed logging for all administrative actions and monitor for anomalies.
• Conduct regular security audits of the CyberPanel codebase.
• Subscribe to CyberPanel security advisories for future updates.

Valters IT