CVE-2024-51378
CyberPanel Incorrect Default Permissions Vulnerability
Description
CVE-2024-51378 is a critical authentication bypass and OS command injection vulnerability in CyberPanel (also known as Cyber Panel) before version 2.3.8. The flaw allows remote, unauthenticated attackers to bypass the security middleware and execute arbitrary operating system commands via the /dns/getresetstatus or /ftp/getresetstatus endpoints by using shell metacharacters in the statusfile property. With a maximum CVSS v3.1 base score of 10.0 and a changed scope, this vulnerability grants attackers complete control over the hosting server and all websites it manages. CISA has confirmed active exploitation and added CVE-2024-51378 to the Known Exploited Vulnerabilities catalog with a remediation deadline of December 25, 2024, and its EPSS score of 93.85% at the 99.9th percentile confirms widespread exploitation. This vulnerability is associated with known ransomware campaigns, specifically the PSAUX ransomware that targeted over 22,000 CyberPanel instances in October 2024.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| cyberpanel | cyberpanel | < 2.3.8 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://cwe.mitre.org/data/definitions/420.html(Not Applicable)
- https://cwe.mitre.org/data/definitions/78.html(Not Applicable)
- https://cyberpanel.net/KnowledgeBase/home/change-logs/(Release Notes)
- https://cyberpanel.net/blog/detials-and-fix-of-recent-security-issue-and-patch-of-cyberpanel(Product)
- https://github.com/usmannasir/cyberpanel/commit/1c0c6cbcf71abe573da0b5fddfb9603e7477f683(Patch)
- https://refr4g.github.io/posts/cyberpanel-command-injection-vulnerability/(Exploit)
- https://www.bleepingcomputer.com/news/security/massive-psaux-ransomware-attack-targets-22-000-cyberpanel-instances/(Exploit, Press/Media Coverage)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-51378(US Government Resource)
Weakness Type
CWE-78: OS Command Injection
CVE-2024-51378 is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command), commonly known as OS command injection. The getresetstatus functions in dns/views.py and ftp/views.py incorporate the statusfile parameter directly into shell commands without sanitizing metacharacters such as semicolons, pipes, or backticks. This allows attackers to inject and execute arbitrary operating system commands with the privileges of the CyberPanel web application process, which typically runs with root or elevated privileges on hosting servers.
CWE-420: Unprotected Alternate Channel
The vulnerability also involves CWE-420 (Unprotected Alternate Channel), because the secMiddleware authentication check is only enforced for POST requests. The getresetstatus endpoints can be reached through alternate HTTP methods that bypass the middleware entirely, creating an unprotected channel that circumvents the intended authentication mechanism. This design flaw means that the command injection is exploitable without any authentication.
Impact Analysis
The impact of CVE-2024-51378 is the most severe possible, reflected in its maximum CVSS score of 10.0 with a changed scope (S:C). Confidentiality is fully compromised not only on the CyberPanel server itself but across all hosted websites and services. CyberPanel is a web hosting control panel that manages multiple websites, databases, email accounts, and DNS configurations. Successful exploitation exposes all customer data, database contents, email messages, SSL certificates, and credentials managed by the panel.
Integrity faces catastrophic impact because root-level command execution on a hosting server allows attackers to modify any website content, inject malicious code into hosted applications, alter database records, redirect email, modify DNS records, and implant persistent backdoors. The changed scope means the attacker can affect resources beyond the vulnerable component, impacting all tenants on a shared hosting server.
Availability is devastated, as demonstrated by the PSAUX ransomware campaign that encrypted entire CyberPanel servers, rendering all hosted websites and services inaccessible. The attack requires no authentication (PR:N), no user interaction (UI:N), and has low complexity (AC:L), enabling automated mass exploitation. The EPSS score of 93.85% at the 99.9th percentile and confirmed association with known ransomware campaigns make this one of the most dangerous vulnerabilities disclosed in 2024.
Exploit Maturity
CVE-2024-51378 has reached maximum exploit maturity with devastating real-world impact. CISA has confirmed active exploitation and linked it to known ransomware campaigns. The EPSS score of 93.85% at the 99.9th percentile places it among the most actively exploited vulnerabilities in the entire landscape.
The most significant exploitation event was the PSAUX ransomware attack in October 2024 that targeted approximately 22,000 CyberPanel instances exposed to the internet. Attackers used automated scanning and exploitation tools to compromise vulnerable servers en masse, encrypting files and demanding ransom payments. A detailed technical analysis of the command injection has been publicly disclosed, and the vulnerability has been patched in commit 1c0c6cb of the CyberPanel repository. The combination of trivial exploitability, no authentication requirement, and the high value of hosting server targets has made this vulnerability extremely attractive to both ransomware operators and other malicious actors.
Remediation
-
Update CyberPanel to version 2.3.8 or later immediately. The fix is available through the standard CyberPanel update mechanism or by applying commit 1c0c6cb. The CyberPanel security advisory provides detailed patching instructions.
-
Restrict network access to CyberPanel management ports immediately as a compensating control. Place the CyberPanel web interface (typically port 8090) behind a firewall or VPN to prevent direct internet access. Only allow management access from trusted administrator IP addresses.
-
Conduct a comprehensive forensic investigation on all CyberPanel servers that were running vulnerable versions while exposed to the internet. Check for signs of the PSAUX ransomware, unauthorized SSH keys, web shells, modified cron jobs, new user accounts, and any encrypted files. Examine all hosted websites for injected malicious code or modified files.
-
Reset all credentials managed by or stored on the CyberPanel server, including the CyberPanel admin password, database passwords for all hosted sites, email account credentials, FTP credentials, and any API keys or SSL private keys. Assume all credentials on a compromised server have been exposed.
-
Notify affected customers if the server hosts websites for third parties. All tenants on a compromised shared hosting server should be informed of the potential data breach and advised to change their passwords and audit their applications for unauthorized modifications.
Technical Details
CVE-2024-51378 is a combined authentication bypass and OS command injection vulnerability in CyberPanel, a web hosting control panel. The CVSS v3.1 vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, yielding the maximum base score of 10.0 due to the changed scope and maximum impact across all dimensions.
The vulnerability exists in two Python view functions: getresetstatus in dns/views.py and ftp/views.py. These functions accept a statusfile parameter and incorporate it directly into operating system commands without sanitization. The critical authentication bypass stems from a design flaw in CyberPanel's secMiddleware, which only validates authentication for POST requests. By sending requests using other HTTP methods (such as GET or OPTIONS), attackers completely bypass the authentication layer.
Once past the middleware, the attacker supplies a crafted statusfile parameter containing shell metacharacters. For example, injecting a semicolon followed by arbitrary commands (e.g., ; id; whoami;) causes the server to execute those commands in addition to the intended status check. The CyberPanel process typically runs with root privileges on the hosting server, meaning injected commands execute with full system access.
The changed scope (S:C) is critical — CyberPanel manages multiple websites, databases, email accounts, and services on a single server. Compromising the control panel affects all hosted resources, not just the CyberPanel application itself. This cross-boundary impact is what elevates the score to the maximum 10.0, as the attacker escapes the vulnerable component's security context to affect all managed resources on the server.
Frequently Asked Questions
What is CVE-2024-51378?
CVE-2024-51378 is a critical authentication bypass and OS command injection vulnerability in CyberPanel web hosting control panel. It allows unauthenticated remote attackers to execute arbitrary commands on the server by exploiting flaws in the /dns/getresetstatus and /ftp/getresetstatus endpoints.
Was CVE-2024-51378 used in ransomware attacks?
Yes. The PSAUX ransomware campaign exploited CVE-2024-51378 in October 2024, targeting approximately 22,000 CyberPanel instances worldwide. The attackers encrypted server data and demanded ransom payments.
How does the authentication bypass work in CVE-2024-51378?
CyberPanel's security middleware (secMiddleware) only validates authentication for POST requests. By accessing the vulnerable endpoints using other HTTP methods, attackers completely bypass the authentication check, gaining unauthenticated access to the command injection flaw.
What should I do if my CyberPanel server was compromised?
Immediately isolate the server from the network, preserve forensic evidence, and conduct a thorough investigation. All credentials stored on the server should be considered compromised. Check all hosted websites for injected malicious code. Consider rebuilding the server from clean backups and notify all affected customers about the potential data breach.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.