CVE-2024-51567CyberPanel Incorrect Default Permissions Vulnerability
Aktif olarak istismar ediliyor — CyberPanel Incorrect Default Permissions Vulnerability
CISA bu açığın gerçek saldırılarda kullanıldığını 07.11.2024 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 28.11.2024.
Gerekli işlem: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. https://cyberpanel.net/blog/detials-and-fix-of-recent-security-issue-and-patch-of-cyberpanel ; https://nvd.nist.gov/vuln/detail/CVE-2024-51567
Açıklama
upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| cyberpanel | cyberpanel | < 2.3.8 |
Kaynaklar ve yamalar
- https://cwe.mitre.org/data/definitions/78.html Technical Description
- https://dreyand.rs/code/review/2024/10/27/what-are-my-options-cyberpanel-v236-pre-auth-rce ExploitPatch
- https://github.com/usmannasir/cyberpanel/commit/5b08cd6d53f4dbc2107ad9f555122ce8b0996515 Patch
- https://cyberpanel.net/KnowledgeBase/home/change-logs/ Release Notes
- https://cwe.mitre.org/data/definitions/420.html Technical Description
- https://cyberpanel.net/blog/detials-and-fix-of-recent-security-issue-and-patch-of-cyberpanel Product
- https://www.bleepingcomputer.com/news/security/massive-psaux-ransomware-attack-targets-22-000-cyberpanel-instances/ Press/Media Coverage
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-51567 US Government Resource
CPE eşleşmeleri (NVD) (1)
cpe:2.3:a:cyberpanel:cyberpanel:*:*:*:*:*:*:*:*< 2.3.8