CyberPanel - RCE (CVE-2024-51378)
Description
getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.
psychologyCrowdSec Analysis
CVE-2024-51378 is a critical remote code execution vulnerability in CyberPanel versions up to 2.3.6 and unpatched 2.3.7, allowing attackers to bypass authentication and execute arbitrary commands via crafted requests to /dns/getresetstatus or /ftp/getresetstatus. Exploited in the wild, this flaw leverages improper request validation and shell metacharacter injection, potentially leading to full system compromise.
CrowdSec has been tracking this vulnerability and its exploits since 21st of January 2025.
CrowdSec has not observed any significant exploitation activity targeting CVE-2024-51378 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers exploit CyberPanel by sending crafted OPTIONS requests to /ftp/getresetstatus or /dns/getresetstatus, enabling remote code execution via command injection in the statusfile parameter.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2024-10-29 |
| CISA KEV | 2024-12-04 |
| CISA Remediation Deadline | 2024-12-25 |
| Rule Released | 2025-01-21 |
| CrowdSec First Seen | 2025-12-17 |
Related Weaknesses
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
During installation, installed file permissions are set to allow anyone to modify those files.
Remediation & Protection
External References
- https://cwe.mitre.org/data/definitions/78.html
- https://github.com/usmannasir/cyberpanel/commit/1c0c6cbcf71abe573da0b5fddfb9603e7477f683
- https://cyberpanel.net/KnowledgeBase/home/change-logs/
- https://cwe.mitre.org/data/definitions/420.html
- https://cyberpanel.net/blog/detials-and-fix-of-recent-security-issue-and-patch-of-cyberpanel
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-51378.yaml