CVE-2024-51567
CRITICAL KEV RANSOMWARE NUCLEICyberPanel Multi CVE Pre-auth RCE
Title source: metasploitExploitation Summary
CVE-2024-51567 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 7, 2024, with confirmed use in ransomware campaigns.
EIP tracks 4 public exploits from researchers including ajayalf, thehash007, KKDT12138, including a Metasploit module exploits/unix/webapp/cyberpanel_preauth_rce_multi_cve.
A Nuclei detection template is also available.
AI-analyzed exploit summary This is a functional Python exploit for CVE-2024-51567, a command injection vulnerability in CyberPanel's `upgrademysqlstatus` endpoint. It bypasses CSRF protections to achieve remote code execution (RCE) via shell metacharacters in the `statusfile` parameter.
Description
upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.
Exploits (4)
This is a functional Python exploit for CVE-2024-51567, a command injection vulnerability in CyberPanel's `upgrademysqlstatus` endpoint. It bypasses CSRF protections to achieve remote code execution (RCE) via shell metacharacters in the `statusfile` parameter.
This exploit leverages a command injection vulnerability in CyberPanel's database upgrade endpoint by manipulating the 'statusfile' parameter. It bypasses CSRF protection and executes arbitrary commands via a crafted JSON payload.
This PoC exploits a command injection vulnerability in CyberPanel versions 2.3.6 and 2.3.7 by bypassing CSRF protection and injecting commands via the 'statusfile' parameter in the 'upgrademysqlstatus' endpoint. It includes an interactive shell for command execution.
This Metasploit module exploits three unauthenticated RCE vulnerabilities in CyberPanel (CVE-2024-51567, CVE-2024-51568, CVE-2024-51378) via command injection in different endpoints. It includes detection logic, CSRF token handling, and payload execution for Unix/Linux targets.
Nuclei Templates (1)
html:"CyberPanel"
References (8)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H