CyberPanel Vulnerability Exposes Systems to Remote Command Execution

What changed

A significant vulnerability has been identified in CyberPanel, specifically in the upgrademysqlstatus function within the databases/views.py file. This flaw allows remote attackers to bypass authentication mechanisms and execute arbitrary commands.

The vulnerability arises from incorrect default permissions, which can be exploited by leveraging shell metacharacters in the statusfile property. This issue has been actively exploited in the wild since October 2024.

Who is affected

The following products and versions are impacted by this vulnerability:

Organizations using CyberPanel versions up to and including 2.3.6, as well as unpatched version 2.3.7, are at risk.

• CyberPanel versions 2.3.6 and 2.3.7
• Organizations utilizing CyberPanel for web hosting services
• Developers and system administrators managing databases through CyberPanel

What to do

It is imperative for affected users to take immediate action to mitigate the risk associated with this vulnerability.

Users should upgrade to the latest patched version of CyberPanel to eliminate the risk of exploitation.

• Upgrade to the latest version of CyberPanel as soon as possible.
• Review and adjust permissions for sensitive files and functions.
• Monitor systems for any unauthorized access or command execution attempts.