Veille CVE
CVE-2024-51378
9.8 Critique Exploitée activement Utilisée par des rançongicielsCatalogue CISA KEV — CyberPanel Incorrect Default Permissions Vulnerability
Ajoutée le 04/12/2024 · Échéance de correction (agences US) : 25/12/2024
Action requise : Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description
getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 10.0 Critique | cve@mitre.org | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| 3.1 | 9.8 Critique | nvd@nist.gov (NVD) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Faiblesses (CWE)
Références
- https://cwe.mitre.org/data/definitions/420.html Not Applicable
- https://cwe.mitre.org/data/definitions/78.html Not Applicable
- https://cyberpanel.net/KnowledgeBase/home/change-logs/ Release Notes
- https://cyberpanel.net/blog/detials-and-fix-of-recent-security-issue-and-patch-of-cyberpanel Product
- https://github.com/usmannasir/cyberpanel/commit/1c0c6cbcf71abe573da0b5fddfb9603e7477f683 Patch
- https://refr4g.github.io/posts/cyberpanel-command-injection-vulnerability/ Exploit
- https://www.bleepingcomputer.com/news/security/massive-psaux-ransomware-attack-targets-22-000-cyberpanel-instances/ ExploitPress/Media Coverage
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-51378 US Government Resource