CyberPanel Remote Code Execution Scanner

CyberPanel is a popular web hosting control panel used by web hosting providers and businesses for managing and automating web-related tasks. It supports Linux operating systems and offers features such as server management, website automation, and database management. Its user-friendly interface and comprehensive feature set make it a choice for hosting providers looking to offer reliable services without extensive command line expertise. CyberPanel is beneficial for users wanting to efficiently manage multiple websites and improve server performance, providing tools for SSL management, domain hosting, and email service management.

The Remote Code Execution vulnerability in CyberPanel is a serious security flaw that permits unauthorized attackers to execute arbitrary code on the server remotely. This type of vulnerability arises when the application fails to validate or sanitize inputs correctly, allowing attackers to insert and execute malicious code. It can result in full control over the application or underlying server, compromising system integrity and data security. Remote Code Execution vulnerabilities are especially critical as they can lead to unauthorized access to sensitive information or further exploitation of network resources.

This vulnerability, affecting CyberPanel version 2.3.6, exploits mismanagement in handling HTTP requests that allows attackers to pass crafted inputs. The vulnerable endpoint in this context is /dataBases/upgrademysqlstatus, where an attacker can inject and execute arbitrary commands. The issue stems from insufficient validation of input parameters such as the 'statusfile', facilitating command injection through manipulated requests. Consequently, bypassing authentication enables execution of commands, jeopardizing server and data security.

Exploiting the Remote Code Execution vulnerability in CyberPanel can lead to severe consequences, including unauthorized access and control over the server. Potential effects include data theft, server outages, defacement, and deployment of malware, which can compromise additional systems. The infiltration could also allow attackers to pivot within the network, targeting other vulnerable systems and escalating privileges. Ultimately, without mitigation, this vulnerability exposes cybersecurity risks that can lead to significant operational and reputational damage.

REFERENCES

• https://community.cyberpanel.net/t/cyberpanel-2-1-remote-code-execution-rce/31760
• https://dreyand.rs/code/review/2024/10/27/what-are-my-options-cyberpanel-v236-pre-auth-rce