CVE-2024-51567
CyberPanel Incorrect Default Permissions Vulnerability
Description
CVE-2024-51567 is a maximum-severity pre-authentication remote code execution vulnerability in CyberPanel (also known as Cyber Panel) before version 2.3.8, scoring a perfect 10.0 on the CVSS v3.1 scale. The vulnerability exists in the upgrademysqlstatus function within databases/views.py, where an attacker can bypass authentication by exploiting a middleware flaw and inject arbitrary OS commands via the statusfile property. This vulnerability was actively exploited in October 2024 by the PSAUX ransomware group, compromising approximately 22,000 CyberPanel instances. CISA has added it to the KEV catalog with a deadline of November 28, 2024, and it carries an EPSS score of 0.9431 (99.9th percentile).
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| cyberpanel | cyberpanel | < 2.3.8 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://cwe.mitre.org/data/definitions/420.html(Technical Description)
- https://cwe.mitre.org/data/definitions/78.html(Technical Description)
- https://cyberpanel.net/KnowledgeBase/home/change-logs/(Release Notes)
- https://cyberpanel.net/blog/detials-and-fix-of-recent-security-issue-and-patch-of-cyberpanel(Product)
- https://dreyand.rs/code/review/2024/10/27/what-are-my-options-cyberpanel-v236-pre-auth-rce(Exploit, Patch)
- https://github.com/usmannasir/cyberpanel/commit/5b08cd6d53f4dbc2107ad9f555122ce8b0996515(Patch)
- https://www.bleepingcomputer.com/news/security/massive-psaux-ransomware-attack-targets-22-000-cyberpanel-instances/(Press/Media Coverage)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-51567(US Government Resource)
Weakness Type
The specific CWE classifications for CVE-2024-51567 have not been formally assigned by the vendor, but the vulnerability maps to two distinct weakness categories. The first is authentication bypass — the secMiddleware that protects the /dataBases/upgrademysqlstatus endpoint only validates POST requests, allowing attackers to bypass it entirely by using alternative HTTP methods. The second weakness is OS command injection — once authentication is bypassed, the statusfile parameter is passed to a system command without proper sanitization, allowing shell metacharacters to be injected and arbitrary commands to be executed. This combination of authentication bypass and command injection creates a devastating pre-auth RCE vector that requires no credentials and no user interaction.
Impact Analysis
CVE-2024-51567 represents the maximum possible impact with a perfect CVSS score of 10.0. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) indicates network-accessible exploitation with low complexity, no privileges, no user interaction, and a Changed scope — meaning the compromise extends beyond CyberPanel itself to affect the underlying operating system and all hosted websites. Confidentiality, integrity, and availability are all rated High, reflecting complete system compromise. Business impact is catastrophic: CyberPanel is a web hosting control panel that typically manages multiple websites, databases, email accounts, and DNS records. Compromising a CyberPanel instance gives attackers access to all hosted customer data, the ability to modify any website content, inject malware into hosted sites, exfiltrate databases, and use the server for further attacks. The confirmed PSAUX ransomware campaign demonstrated this impact at scale, encrypting files across approximately 22,000 instances. The EPSS score of 0.9431 (99.9th percentile) and confirmed ransomware association make this one of the most dangerous vulnerabilities disclosed in 2024.
Exploit Maturity
CVE-2024-51567 has been massively exploited in the wild, most notably by the PSAUX ransomware group in October 2024. The attack was widely reported, with approximately 22,000 CyberPanel instances compromised in a coordinated campaign. CISA added this vulnerability to its Known Exploited Vulnerabilities catalog with a remediation deadline of November 28, 2024, and the ransomware usage is classified as "Known." A detailed exploit analysis and proof-of-concept is publicly available, along with the patch commit on GitHub. The EPSS score of 0.9431 (99.9th percentile) confirms near-certain exploitation probability. The trivial nature of the exploit — requiring only a crafted HTTP request to an unauthenticated endpoint — combined with the large number of internet-exposed CyberPanel instances made this a prime target for automated mass exploitation.
Remediation
- Update CyberPanel to version 2.3.8 or later immediately — Apply the fix referenced in the CyberPanel security advisory and verify the patch commit is included in your installation.
- Check for indicators of compromise — If your CyberPanel instance was exposed before patching, assume compromise. Look for encrypted files (PSAUX ransomware signatures), unauthorized SSH keys, new cron jobs, unfamiliar processes, and modified system files. Examine web server logs for requests to /dataBases/upgrademysqlstatus.
- Restrict network access to the CyberPanel management interface — Place the admin panel behind a VPN or restrict access to trusted IP addresses only. The management interface should never be directly exposed to the public internet.
- Rebuild compromised systems from clean backups — If compromise is confirmed, do not attempt to clean the infected system. Rebuild from known-good backups, apply all patches before reconnecting to the network, and rotate all credentials including database passwords, email accounts, and API keys.
- Implement web application firewall rules — Deploy WAF rules to detect and block command injection patterns and requests to the vulnerable endpoint as an additional defense layer for any remaining unpatched instances.
Technical Details
The CVSS v3.1 vector for CVE-2024-51567 is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, resulting in the maximum base score of 10.0. Attack Vector (Network) confirms remote exploitation over HTTP/HTTPS. Attack Complexity (Low) means the exploit is trivially reliable. Privileges Required (None) and User Interaction (None) confirm this is a fully unauthenticated, automated attack. Scope (Changed) is critical — it means the vulnerability in CyberPanel's web application extends to compromise the underlying operating system, all hosted websites, and associated services. All three impact metrics — Confidentiality, Integrity, and Availability — are rated High. The attack mechanism targets the upgrademysqlstatus endpoint in databases/views.py. CyberPanel's secMiddleware only enforces authentication on POST requests, so an attacker can bypass it by sending a request that avoids the POST method check. Once past authentication, the statusfile parameter in the request body is concatenated into a shell command without sanitization. By injecting shell metacharacters (such as semicolons or backticks), an attacker executes arbitrary OS commands with the privileges of the CyberPanel process, which typically runs as root or with sudo access.
Frequently Asked Questions
What is CVE-2024-51567?
CVE-2024-51567 is a critical pre-authentication remote code execution vulnerability in CyberPanel, a web hosting control panel. It allows unauthenticated attackers to bypass authentication middleware and execute arbitrary operating system commands by injecting shell metacharacters into the statusfile parameter of the upgrademysqlstatus endpoint.
Was CVE-2024-51567 used in ransomware attacks?
Yes, the PSAUX ransomware group exploited this vulnerability in October 2024, compromising approximately 22,000 CyberPanel instances in a mass attack. The attackers encrypted files on compromised servers and demanded ransom payments, demonstrating the devastating real-world impact of this vulnerability.
How do I know if my CyberPanel was compromised?
Check for encrypted files, unauthorized SSH keys in /root/.ssh/authorized_keys, unfamiliar cron jobs, and suspicious processes. Review your web server access logs for requests targeting /dataBases/upgrademysqlstatus. If your CyberPanel was internet-exposed and running a version before 2.3.8, assume compromise and plan for a full rebuild.
How do I fix CVE-2024-51567?
Update CyberPanel to version 2.3.8 or later immediately. If you suspect compromise, rebuild the server from clean backups rather than attempting to clean the infection. Restrict the management interface to trusted IPs only and never expose it directly to the internet.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.