CVE-2024-32739
📋 TL;DR
An unauthenticated SQL injection vulnerability in CyberPower PowerPanel Enterprise allows remote attackers to execute arbitrary SQL commands and leak sensitive information. This affects PowerPanel Enterprise versions prior to v2.8.3. Attackers can exploit this without authentication via the query_ptask_verbose function.
💻 Affected Systems
- CyberPower PowerPanel Enterprise
📦 What is this software?
Powerpanel by Cyberpower
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including credential theft, configuration data exfiltration, and potential system takeover through subsequent attacks.
Likely Case
Sensitive information disclosure including user credentials, system configurations, and operational data from the database.
If Mitigated
Limited impact with proper network segmentation and database permissions, though SQL injection remains possible.
🎯 Exploit Status
Vulnerability is well-documented with specific function identified, making exploitation straightforward for attackers with SQL injection knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v2.8.3
Vendor Advisory: https://www.cyberpower.com/global/en/File/GetFileSampleByType?fileId=SU-18070002-07&fileSubType=FileReleaseNote
Restart Required: Yes
Instructions:
1. Download PowerPanel Enterprise v2.8.3 from CyberPower website. 2. Backup current configuration. 3. Run installer to upgrade. 4. Restart PowerPanel services. 5. Verify version shows 2.8.3.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict network access to PowerPanel Enterprise management interface to trusted IPs only.
Use firewall rules to allow only specific source IPs to PowerPanel port (default 3050)
Database Permission Reduction
allLimit database user permissions to minimum required for PowerPanel operations.
ALTER USER powerpanel_user WITH NOSUPERUSER NOCREATEDB NOCREATEROLE;
🧯 If You Can't Patch
- Implement strict network segmentation to isolate PowerPanel systems from untrusted networks.
- Deploy web application firewall (WAF) with SQL injection protection rules in front of PowerPanel interface.
🔍 How to Verify
Check if Vulnerable:
Check PowerPanel Enterprise version in web interface or configuration files. Versions below 2.8.3 are vulnerable.Check Version:
On Windows: Check PowerPanel installation directory for version.txt. On Linux: Check /opt/CyberPower/PowerPanel/version or similar.Verify Fix Applied:
Verify version shows 2.8.3 in PowerPanel web interface or via version check command.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed authentication attempts followed by SQL-like requests
- Requests to query_ptask_verbose endpoint with suspicious parameters
Network Indicators:
- SQL injection patterns in HTTP requests to PowerPanel
- Unusual database connections from PowerPanel host
- Excessive data transfer from PowerPanel system
SIEM Query:
source="powerpanel.log" AND ("query_ptask_verbose" OR sql_injection_patterns)🔗 References
- https://www.cyberpower.com/global/en/File/GetFileSampleByType?fileId=SU-18070002-07&fileSubType=FileReleaseNote
- https://www.tenable.com/security/research/tra-2024-14
- https://www.cyberpower.com/global/en/File/GetFileSampleByType?fileId=SU-18070002-07&fileSubType=FileReleaseNote
- https://www.tenable.com/security/research/tra-2024-14
