CVE-2024-53376
📋 TL;DR
This vulnerability allows remote authenticated users to execute arbitrary commands on CyberPanel servers via shell injection in the phpSelection field during website creation. Attackers with valid credentials can achieve remote code execution. All CyberPanel instances before version 2.3.8 are affected.
💻 Affected Systems
- CyberPanel
📦 What is this software?
Cyberpanel by Cyberpanel
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise leading to data theft, lateral movement, ransomware deployment, or complete system takeover.
Likely Case
Unauthorized command execution leading to web shell installation, data exfiltration, or service disruption.
If Mitigated
Limited impact if proper network segmentation, least privilege, and monitoring are in place.
🎯 Exploit Status
Public exploit script available on GitHub. Requires valid user credentials.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.3.8
Vendor Advisory: https://cyberpanel.net/docs/changelog/
Restart Required: No
Instructions:
1. Backup your CyberPanel configuration. 2. Run: cyberpanel upgrade. 3. Verify version with: cyberpanel --version.
🔧 Temporary Workarounds
Input Validation Filter
linuxAdd input validation to reject shell metacharacters in phpSelection field.
Modify /usr/local/CyberCP/CyberCP/websiteFunctions.py to sanitize phpSelection input
Restrict User Privileges
allLimit authenticated users to minimal necessary permissions.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate CyberPanel from critical systems.
- Enable detailed logging and monitoring for suspicious command execution patterns.
🔍 How to Verify
Check if Vulnerable:
Check CyberPanel version: cyberpanel --version. If version is below 2.3.8, system is vulnerable.Check Version:
cyberpanel --versionVerify Fix Applied:
Run: cyberpanel --version. Confirm version is 2.3.8 or higher.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /websites/submitWebsiteCreation with shell metacharacters in parameters
- Unexpected command execution in system logs
Network Indicators:
- Suspicious outbound connections from CyberPanel server to unknown IPs
SIEM Query:
source="cyberpanel.log" AND uri="/websites/submitWebsiteCreation" AND (phpSelection="*;*" OR phpSelection="*|*" OR phpSelection="*`*")