CyberPanel Vulnerability Exposes Systems to Remote Command Execution

What changed

A significant security flaw has been discovered in CyberPanel, specifically in the handling of requests within the getresetstatus function located in dns/views.py and ftp/views.py. This vulnerability allows unauthorized users to bypass authentication mechanisms and execute arbitrary commands.

The issue arises from the improper configuration of the secMiddleware, which only applies to POST requests, making it possible for attackers to exploit the system using shell metacharacters in the statusfile property.

Who is affected

This vulnerability impacts various versions of CyberPanel, particularly those up to and including 2.3.6 and the unpatched version 2.3.7. Organizations utilizing these versions are at risk of exploitation.

The following groups are particularly vulnerable:

• CyberPanel users running affected versions.
• Organizations relying on CyberPanel for DNS and FTP services.
• Web hosting providers using CyberPanel for client management.
• Any entity that has not applied the latest security patches.

What to do

To mitigate the risks associated with this vulnerability, it is crucial for affected users to update their CyberPanel installations to the latest version as soon as possible. Regularly monitoring for updates and patches can help safeguard systems against potential exploitation.

Additionally, organizations should review their security configurations and consider implementing additional layers of security to protect against unauthorized access.

• Upgrade CyberPanel to the latest version immediately.
• Review and enhance security configurations to prevent unauthorized access.
• Monitor for any unusual activity on systems running CyberPanel.
• Educate staff about the importance of applying security updates promptly.