CVE-2024-51567

upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.

CVSS v3 10.0 CRITICAL

10.0^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://cwe.mitre.org/data/definitions/420.html	Technical Description
https://cwe.mitre.org/data/definitions/78.html	Technical Description
https://cyberpanel.net/KnowledgeBase/home/change-logs/	Release Notes
https://cyberpanel.net/blog/detials-and-fix-of-recent-security-issue-and-patch-of-cyberpanel	Product
https://dreyand.rs/code/review/2024/10/27/what-are-my-options-cyberpanel-v236-pre-auth-rce	Exploit Patch
https://github.com/usmannasir/cyberpanel/commit/5b08cd6d53f4dbc2107ad9f555122ce8b0996515	Patch
https://www.bleepingcomputer.com/news/security/massive-psaux-ransomware-attack-targets-22-000-cyberpanel-instances/	Press/Media Coverage

Configurations

Configuration 1 (hide)

cpe:2.3:a:cyberpanel:cyberpanel:*:*:*:*:*:*:*:*

History

05 Feb 2025, 20:15

Type	Values Removed	Values Added
CWE	~~CWE-276~~

Information

Published : 2024-10-29 23:15

Updated : 2025-04-03 20:40

NVD link : CVE-2024-51567

Mitre link : CVE-2024-51567

CVE.ORG link : CVE-2024-51567

JSON object : View

Products Affected

cyberpanel

cyberpanel

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2024-51567", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2024-10-29T23:15:04.307", "references": [{"url": "https://cwe.mitre.org/data/definitions/420.html", "tags": ["Technical Description"], "source": "cve@mitre.org"}, {"url": "https://cwe.mitre.org/data/definitions/78.html", "tags": ["Technical Description"], "source": "cve@mitre.org"}, {"url": "https://cyberpanel.net/KnowledgeBase/home/change-logs/", "tags": ["Release Notes"], "source": "cve@mitre.org"}, {"url": "https://cyberpanel.net/blog/detials-and-fix-of-recent-security-issue-and-patch-of-cyberpanel", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://dreyand.rs/code/review/2024/10/27/what-are-my-options-cyberpanel-v236-pre-auth-rce", "tags": ["Exploit", "Patch"], "source": "cve@mitre.org"}, {"url": "https://github.com/usmannasir/cyberpanel/commit/5b08cd6d53f4dbc2107ad9f555122ce8b0996515", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "https://www.bleepingcomputer.com/news/security/massive-psaux-ransomware-attack-targets-22-000-cyberpanel-instances/", "tags": ["Press/Media Coverage"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-306"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected."}, {"lang": "es", "value": " upgrademysqlstatus en databases/views.py en CyberPanel (tambi\u00e9n conocido como Cyber Panel) anterior a 5b08cd6 permite a atacantes remotos omitir la autenticaci\u00f3n y ejecutar comandos arbitrarios a trav\u00e9s de /dataBases/upgrademysqlstatus omitiendo secMiddleware (que es solo para una solicitud POST) y utilizando metacaracteres de shell en la propiedad statusfile, como lo explot\u00f3 PSAUX en octubre de 2024. Las versiones hasta 2.3.6 y 2.3.7 (sin parchear) se ven afectadas."}], "lastModified": "2025-04-03T20:40:23.433", "cisaActionDue": "2024-11-28", "cisaExploitAdd": "2024-11-07", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cyberpanel:cyberpanel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4AF5FFC6-208E-4DD5-B298-56EFD7047F47", "versionEndExcluding": "2.3.8"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org", "cisaRequiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "cisaVulnerabilityName": "CyberPanel Incorrect Default Permissions Vulnerability"}