CVE-2024-51378

CyberPanel versions through 2.3.6, and 2.3.7 before commit 1c0c6cb, contain an OS command injection flaw (CWE-78) in the getresetstatus functions of dns/views.py and ftp/views.py. Because the security middleware (secMiddleware) only enforces authentication on POST requests, a remote unauthenticated attacker can send a GET request to /dns/getresetstatus or /ftp/getresetstatus and inject shell metacharacters into the statusfile parameter, executing arbitrary commands as the service. Successful exploitation yields full command execution on the hosting server with high impact to confidentiality, integrity, and availability (CVSS 9.8). Any internet-exposed CyberPanel instance, commonly used by web hosts to manage DNS and FTP services, is affected. The flaw was mass-exploited in the wild in October 2024 by the PSAUX ransomware group against roughly 22,000 CyberPanel instances, and CISA added it to the Known Exploited Vulnerabilities catalog on 2024-12-04 with ransomware use confirmed.

What to do: Upgrade CyberPanel to a build that includes commit 1c0c6cb or later (2.3.7 alone is unpatched), per vendor instructions, or discontinue/restrict use of the product per CISA's KEV required action. Check web access logs for GET requests to /dns/getresetstatus and /ftp/getresetstatus from unauthenticated sources and review servers for PSAUX ransomware indicators. If immediate patching is not possible, restrict panel endpoints to trusted networks and block unauthenticated GET access to the affected routes.