Actively exploited in the wild
CyberPanel Incorrect Default Permissions Vulnerability
CyberPersons - CyberPanel · Listed in the CISA KEV since 2024-11-07. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2024-51567
CriticalCVSS 10.0KEVExploitation Probability (EPSS)
Very high risk100th percentile - higher than 100% of all known CVEs
Summary
The upgrademysqlstatus function in databases/views.py in CyberPanel before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.
Risk Assessment
An unauthenticated attacker can execute arbitrary commands on the server, leading to full takeover of the panel and system.
Recommendation
Update CyberPanel to a patched version (after 5b08cd6) and restrict access to the panel.
Original NVD description (English source)
upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.