# CVE-2022-44877: Control Web Panel - RCE

> Live exploitation tracking for CVE-2022-44877 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2022-44877

## Key facts

- **Exploitation phase:** Background Noise. Continuous low-level scanning or exploitation attempts are observed, mostly opportunistic and automated.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** Control Web Panel
- **Weaknesses:** CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))
- **Tags:** web_application

## Description

login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the login parameter.

## CrowdSec analysis

[CVE-2022-44877](https://euvd.enisa.europa.eu/vulnerability/CVE-2022-44877) is a critical vulnerability affecting Control Web Panel that allows remote attackers to execute arbitrary operating system commands by manipulating the login input parameter.

CrowdSec has been tracking this vulnerability and its exploits since 20th of January 2023.

CrowdSec network observations suggest that most exploitation of CVE-2022-44877 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental.
Telemetry from the CrowdSec network also shows that exploitation activity for CVE-2022-44877 remains steady week-over-week. Attack volumes are consistent with long-term trends, indicating sustained interest from threat actors. CVE-2022-44877 continues to be an active part of the threat landscape and will likely remain this way for the forseeable future.

Exploitation attempts frequently involve requests to URLs referencing `login/index.php`.

## Timeline

- 2023-01-05: CVE Published. CVE-2022-44877 is published to NVD.
- 2023-01-17: CISA KEV. CVE-2022-44877 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2023-01-20: Rule Released. CrowdSec releases a rule to detect CVE-2022-44877 exploitation attempts against the CrowdSec Network.
- 2023-02-07: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).
- 2024-11-23: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2022-44877 for the first time.

## References

- https://www.youtube.com/watch?v=kiLfSvc1SYY
- https://gist.github.com/numanturle/c1e82c47f4cba24cff214e904c227386
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-44877.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2022-44877) follows observed exploitation activity for CVE-2022-44877. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.