CVE-2024-51378
CRITICAL KEV RANSOMWARE NUCLEICyberPanel < 2.3.8 - Unauthenticated OS Command Injection via DNS/FTP getresetstatus Endpoint
Title source: llmExploitation Summary
CVE-2024-51378 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added December 4, 2024, with confirmed use in ransomware campaigns.
EIP tracks 5 public exploits from researchers including Luka Petrovic (refr4g), refr4g, rimbadirgantara, including a Metasploit module exploits/unix/webapp/cyberpanel_preauth_rce_multi_cve.
A Nuclei detection template is also available.
AI-analyzed exploit summary This exploit leverages a command injection vulnerability in CyberPanel versions 2.3.5 to 2.3.7 (pre-patch) via the '/ftp/getresetstatus' or '/dns/getresetstatus' endpoints. It bypasses CSRF protection and injects commands into the 'statusfile' parameter.
Description
getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.
Exploits (5)
This exploit leverages a command injection vulnerability in CyberPanel versions 2.3.5 to 2.3.7 (pre-patch) via the '/ftp/getresetstatus' or '/dns/getresetstatus' endpoints. It bypasses CSRF protection and injects commands into the 'statusfile' parameter.
This is a functional exploit for CVE-2024-51378, a command injection vulnerability in CyberPanel. It leverages crafted OPTIONS requests to vulnerable endpoints to achieve unauthenticated remote code execution.
This repository contains a functional exploit for CVE-2024-51378, targeting CyberPanel versions up to 2.3.7. The exploit leverages a Remote Code Execution (RCE) vulnerability via CSRF token manipulation and endpoint injection, allowing arbitrary command execution or SSH key deployment.
The repository contains a working PoC for CVE-2024-51378, demonstrating command injection via OPTIONS requests to specific endpoints in CyberPanel. It includes scripts for exploitation and scanning vulnerable hosts.
This Metasploit module exploits three separate unauthenticated Remote Code Execution vulnerabilities in CyberPanel (CVE-2024-51567, CVE-2024-51568, CVE-2024-51378) via command injection in different endpoints. It includes detection, vulnerability testing, and payload execution capabilities.
Nuclei Templates (1)
html:"CyberPanel"
app="CyberPanel"
References (8)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H