Critical Vulnerability in CyberPanel Allows Remote Command Execution

What changed

A flaw in CyberPanel's handling of permissions has been discovered, specifically in the upgrademysqlstatus function within databases/views.py. This vulnerability allows attackers to bypass authentication mechanisms, leading to potential remote command execution.

The issue arises from the secMiddleware being ineffective for certain requests, enabling exploitation through crafted input.

Who is affected

The vulnerability impacts various users and organizations utilizing CyberPanel, particularly those running versions up to 2.3.6 and the unpatched 2.3.7.

As this flaw has been actively exploited since October 2024, it poses a significant risk to those who have not yet updated their installations.

• CyberPanel users running affected versions.
• Web hosting providers utilizing CyberPanel for client management.
• Developers and system administrators managing databases through CyberPanel.

What to do

It is crucial for affected users to take immediate action to mitigate the risks associated with this vulnerability. Updating to the latest version of CyberPanel is highly recommended.

Additionally, organizations should review their security policies and consider implementing additional layers of security to protect against potential exploitation.

• Upgrade CyberPanel to the latest version to patch the vulnerability.
• Review and tighten access controls and permissions within the application.
• Monitor systems for any signs of unauthorized access or exploitation.