CyberPanel vulnerabilities

CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the WebTerminal FastAPI SSH service that allows unauthenticated remote attackers to forge valid authentication tokens and obtain an interactive root shell via WebSocket on port 8888. Attackers can craft a forged JWT signed with the hardcoded secret value, specifying ssh_user=root, to authenticate to the terminal service without any valid credentials and receive a root shell.

CyberPanel versions prior to 2.4.5 contain an authentication bypass vulnerability in the AI Scanner worker API endpoints that allows unauthenticated remote attackers to write arbitrary data to the database by sending requests to /api/ai-scanner/status-webhook and /api/ai-scanner/callback. Attackers can exploit the lack of authentication checks to cause denial of service through storage exhaustion, corrupt scan history records, and pollute database fields with malicious data.

CyberPanel v1.9.1 contains a path traversal vulnerability in the compress method exposed through the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply absolute or otherwise out-of-scope file paths in the listOfFiles JSON property, together with attacker-controlled basePath and compressedFileName values, in a method=compress request.

CyberPanel 1.9.1 contains a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply an arbitrary absolute or out-of-scope path in the fileName JSON property.

CyberPanel before 2.4.4 has no logging for actions that could potentially manipulate the child domains list. The lack of logging makes it difficult to detect unauthorized changes.

CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second domain that serves the same content as a primary domain; normally spelled "alias") via an ORM query filter rather than a Python "if" statement.

CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic. This may lead to incorrect function behavior.

CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. An attacker who obtains an administrator's password can derive API tokens and perform administrative operations or create authenticated sessions without the second factor.

CyberPanel versions 2.4.3 through 2.4.5 expose unauthenticated AI Scanner debugging endpoints that disclose administrator usernames, API-key prefixes, scan identifiers, target domains, and account metadata. Unauthenticated attackers can enumerate panel administrators and recent scanner activity to inventory multi-tenant installations and facilitate follow-on attacks.

CyberPanel before version 3.0.0 has a path traversal vulnerability that allows authenticated administrators to read arbitrary files from the server filesystem by supplying unsanitized file paths to the cloudAPI ReadReport endpoint. Attackers can access credential files, SSL/SSH private keys, and JWT secret files.

CyberPanel 2.4.3 contains an authenticated command injection vulnerability in the remote backup transfer feature. Attackers can control a remote server's API response and inject malicious commands via a crafted directory name, which bypasses security middleware and is passed unsanitized to the OS command execution function.

CyberPanel 2.4.3 contains an authenticated remote code execution vulnerability in the remote backup feature. Attackers can supply a malicious remote server address, allowing them to write an attacker-controlled public key to /root/.ssh/authorized_keys, granting persistent root access to the host system.

CyberPanel 2.4.3 contains an arbitrary file read vulnerability in the file manager component that allows authenticated attackers to read sensitive system files by uploading a crafted ZIP archive containing symbolic links. The application fails to validate symlinks before extraction, allowing symbolic links targeting arbitrary filesystem paths outside the user's home directory to persist and be accessed through the web interface.

CyberPanel through 1.9.1, fixed in commit b198460, contains an IDOR vulnerability in the IncBackups application's incremental-backup handlers (deleteBackup, fetchRestorePoints, restorePoint). Authenticated panel users can access or manipulate other tenants' backup resources by supplying an attacker-controlled globally sequential IncJob integer ID that is never re-scoped to the authorized domain. Attackers can enumerate sequential backup IDs to read another tenant's backup metadata, irrecoverably delete another tenant's backup snapshots, or trigger unauthorized restoration of another tenant's backup job with root privileges.

CyberPanel up to version 1.9.1 lacks authorization in the cancelBackupCreation handler. An authenticated attacker can send crafted POST requests with arbitrary parameters to kill, delete, and corrupt other tenants' backups.

CyberPanel 2.1 contains a command execution vulnerability that allows authenticated attackers to read arbitrary files and execute remote code by exploiting symlink attacks through the filemanager controller endpoint.

CyberPanel versions prior to 2.4.5 contain a stored cross-site scripting vulnerability in the AI Scanner dashboard where the POST /api/ai-scanner/callback endpoint lacks authentication and allows unauthenticated attackers to inject malicious JavaScript by overwriting the findings_json field of ScanHistory records. Attackers can inject JavaScript that executes in an administrator's authenticated session when they visit the AI Scanner dashboard, allowing them to issue same-origin requests to plant cron jobs and achieve remote code execution on the server.