CyberPanel - Authentication Bypass (CVE-2024-51567)
Description
upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.
psychologyCrowdSec Analysis
CVE-2024-51567 is a critical vulnerability in CyberPanel that enables remote attackers to bypass authentication and execute arbitrary commands via crafted requests, abusing inadequate request filtering on a specific endpoint.
CrowdSec has been tracking this vulnerability and its exploits since 13th of November 2024.
CrowdSec has not observed any significant exploitation activity targeting CVE-2024-51567 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Observed exploitation attempts focus on requests to the /databases/upgrademysqlstatus path.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2024-10-29 |
| CISA KEV | 2024-11-07 |
| Rule Released | 2024-11-13 |
| CrowdSec First Seen | 2024-11-25 |
| CISA Remediation Deadline | 2024-11-28 |
Remediation & Protection
External References
- https://cwe.mitre.org/data/definitions/78.html
- https://dreyand.rs/code/review/2024/10/27/what-are-my-options-cyberpanel-v236-pre-auth-rce
- https://github.com/usmannasir/cyberpanel/commit/5b08cd6d53f4dbc2107ad9f555122ce8b0996515
- https://cyberpanel.net/KnowledgeBase/home/change-logs/
- https://cwe.mitre.org/data/definitions/420.html
- https://cyberpanel.net/blog/detials-and-fix-of-recent-security-issue-and-patch-of-cyberpanel
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-51567.yaml