CVE-2024-51378 Scanner

CyberPanel is a widely adopted web hosting control panel used by hosting providers and system administrators to manage websites, databases, and server resources. It provides a user-friendly interface for tasks like domain management, FTP setup, and DNS configuration, making it popular for both VPS and cloud environments. Its efficiency and security features are critical for maintaining reliable hosting services.

The command injection vulnerability, tracked as CVE-2024-51378, arises from insufficient validation of user-supplied input in specific endpoints. This flaw allows attackers to inject arbitrary shell commands by manipulating the 'statusfile' parameter. The root cause is the lack of proper sanitization and escaping, which enables command execution without authentication.

Technically, the vulnerability affects the /ftp/getresetstatus and /dns/getresetstatus endpoints, where the 'statusfile' parameter is passed directly to system-level functions. Attackers can craft malicious HTTP requests with payloads like semicolons or pipes to execute commands. The security middleware fails to validate OPTIONS requests, bypassing standard checks and exposing the server to exploitation.

If exploited, an attacker can execute arbitrary commands with the privileges of the web server user, leading to full server compromise. This includes data theft, malware installation, and lateral movement within the network. Given the CVSS score of 9.8, this vulnerability poses a critical risk to hosting environments, potentially affecting thousands of websites managed by CyberPanel.