CVE-2024-51378
CRITICAL KEV RANSOMWARE NUCLEICyberpanel < 2.3.8 - OS Command Injection
Title source: ruleDescription
getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.
Exploits (6)
exploitdb
WORKING POC
by Luka Petrovic (refr4g) · pythonwebappsmultiple
https://www.exploit-db.com/exploits/52172
metasploit
WORKING POC
EXCELLENT
by DreyAnd, Valentin Lobstein, Luka Petrovic (refr4g) · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/cyberpanel_preauth_rce_multi_cve.rb
Nuclei Templates (1)
CyberPanel - Command Injection
CRITICALVERIFIEDby ritikchaddha
Shodan:
html:"CyberPanel"
FOFA:
app="CyberPanel"
References (8)
Scores
CVSS v3
10.0
EPSS
0.9385
EPSS Percentile
99.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Details
CISA KEV
2024-12-04
VulnCheck KEV
2024-10-26
InTheWild.io
2024-10-29
ENISA EUVD
EUVD-2024-45807
Ransomware Use
Confirmed
CWE
CWE-78
Status
published
Products (1)
cyberpanel/cyberpanel
< 2.3.8
Published
Oct 29, 2024
KEV Added
Dec 04, 2024
Tracked Since
Feb 18, 2026