# CVE-2024-51378: CyberPanel - RCE

> Live exploitation tracking for CVE-2024-51378 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2024-51378

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 10.0
- **Public exploit available:** Yes
- **Affected products:** CyberPanel
- **Weaknesses:** CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')); CWE-276 (Incorrect Default Permissions)
- **Tags:** file_sharing

## Description

getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.

## CrowdSec analysis

[CVE-2024-51378](https://euvd.enisa.europa.eu/vulnerability/CVE-2024-51378) is a critical remote code execution vulnerability in CyberPanel versions up to 2.3.6 and unpatched 2.3.7, allowing attackers to bypass authentication and execute arbitrary commands via crafted requests to /dns/getresetstatus or /ftp/getresetstatus. Exploited in the wild, this flaw leverages improper request validation and shell metacharacter injection, potentially leading to full system compromise.

CrowdSec has been tracking this vulnerability and its exploits since 21st of January 2025.

CrowdSec has not observed any significant exploitation activity targeting CVE-2024-51378 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit CyberPanel by sending crafted `OPTIONS` requests to `/ftp/getresetstatus` or `/dns/getresetstatus`, enabling remote code execution via command injection in the `statusfile` parameter.

## Timeline

- 2024-10-29: CVE Published. CVE-2024-51378 is published to NVD.
- 2024-12-04: CISA KEV. CVE-2024-51378 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2024-12-25: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).
- 2025-01-21: Rule Released. CrowdSec releases a rule to detect CVE-2024-51378 exploitation attempts against the CrowdSec Network.
- 2025-12-17: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2024-51378 for the first time.

## References

- https://cwe.mitre.org/data/definitions/78.html
- https://github.com/usmannasir/cyberpanel/commit/1c0c6cbcf71abe573da0b5fddfb9603e7477f683
- https://cyberpanel.net/KnowledgeBase/home/change-logs/
- https://cwe.mitre.org/data/definitions/420.html
- https://cyberpanel.net/blog/detials-and-fix-of-recent-security-issue-and-patch-of-cyberpanel
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-51378.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2024-51378) follows observed exploitation activity for CVE-2024-51378. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.