# CVE-2024-51567: CyberPanel - Authentication Bypass

> Live exploitation tracking for CVE-2024-51567 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2024-51567

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 10.0
- **Public exploit available:** Yes
- **Affected products:** CyberPanel
- **Weaknesses:** CWE-306 (Missing Authentication for Critical Function)
- **Tags:** management_panel

## Description

upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.

## CrowdSec analysis

[CVE-2024-51567](https://euvd.enisa.europa.eu/vulnerability/CVE-2024-51567) is a critical vulnerability in CyberPanel that enables remote attackers to bypass authentication and execute arbitrary commands via crafted requests, abusing inadequate request filtering on a specific endpoint.

CrowdSec has been tracking this vulnerability and its exploits since 13th of November 2024.

CrowdSec has not observed any significant exploitation activity targeting CVE-2024-51567 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Observed exploitation attempts focus on requests to the `/databases/upgrademysqlstatus` path.

## Timeline

- 2024-10-29: CVE Published. CVE-2024-51567 is published to NVD.
- 2024-11-07: CISA KEV. CVE-2024-51567 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2024-11-13: Rule Released. CrowdSec releases a rule to detect CVE-2024-51567 exploitation attempts against the CrowdSec Network.
- 2024-11-25: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2024-51567 for the first time.
- 2024-11-28: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).

## References

- https://cwe.mitre.org/data/definitions/78.html
- https://dreyand.rs/code/review/2024/10/27/what-are-my-options-cyberpanel-v236-pre-auth-rce
- https://github.com/usmannasir/cyberpanel/commit/5b08cd6d53f4dbc2107ad9f555122ce8b0996515
- https://cyberpanel.net/KnowledgeBase/home/change-logs/
- https://cwe.mitre.org/data/definitions/420.html
- https://cyberpanel.net/blog/detials-and-fix-of-recent-security-issue-and-patch-of-cyberpanel
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-51567.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2024-51567) follows observed exploitation activity for CVE-2024-51567. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.