CVE-2024-51378
About
getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.
Rainforest analyst review
CyberPanel's `getresetstatus` endpoints in the DNS and FTP views can be called without authentication because the security middleware guarding them only applies to POST requests, and these routes are reachable another way. Having bypassed the auth check, an attacker supplies shell metacharacters in the `statusfile` property, which is passed into a system command, yielding arbitrary command execution as root on the panel host. Two independent weaknesses — an auth filter that misses the request path and unsanitized input reaching a shell — combine into a trivial pre-auth RCE.
CyberPanel manages web hosting, DNS, email, and databases for the sites it fronts, so a compromised panel hands an attacker every domain and service it administers, a natural jackpot for mass exploitation. In October 2024 the PSAUX ransomware campaign weaponized this against thousands of internet-exposed CyberPanel instances almost immediately after disclosure, encrypting servers at scale. Update past the patched commit (versions through 2.3.6, and unpatched 2.3.7, are affected), and because exploitation was broad and fast, assume any previously exposed instance was hit — hunt for ransomware artifacts and unexpected root activity rather than patching and moving on.
References
- https://cwe.mitre.org/data/definitions/420.html
- https://cwe.mitre.org/data/definitions/78.html
- https://cyberpanel.net/KnowledgeBase/home/change-logs/
- https://cyberpanel.net/blog/detials-and-fix-of-recent-security-issue-and-patch-of-cyberpanel
- https://github.com/usmannasir/cyberpanel/commit/1c0c6cbcf71abe573da0b5fddfb9603e7477f683
- https://refr4g.github.io/posts/cyberpanel-command-injection-vulnerability/
- https://www.bleepingcomputer.com/news/security/massive-psaux-ransomware-attack-targets-22-000-cyberpanel-instances/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-51378
Related CVEs
Frequently asked questions
What is CVE-2024-51378?
getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX.
How severe is CVE-2024-51378?
CVE-2024-51378 carries a CVSS 3.1 base score of 10, rated critical. On the Rainforest Risk Index — which weighs the severity alongside how easy the flaw is to reach and how broad its impact is — it scores 100 out of 100, in the critical band.
How is CVE-2024-51378 exploited?
According to the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H): attack vector Network, attack complexity Low, privileges required None, user interaction None. Impact on confidentiality High, integrity High and availability High.
Which products are affected by CVE-2024-51378?
Public advisories list the following as affected: cyberpanel. Check the references on this page for the exact versions each vendor confirms.
How do I fix CVE-2024-51378?
Apply the fix the vendor published — the references on this page link to the primary advisories and patches. When patching can't happen right away, reduce the exposure of the affected component and watch it for exploitation attempts. Rainforest customers see this vulnerability correlated to their own assets and prioritized by real exposure, not by score alone.
Empower Your Security Strategy with Rainforest
Discover vulnerabilities early, prioritize critical threats, and protect what truly matters. Rainforest streamlines your security operations, saving you time and reducing costs, so you can focus on what drives your business forward.