CVE-2024-51567

CyberPanel, a web hosting control panel, contains a missing-authentication flaw (CWE-306) in the upgrademysqlstatus function in databases/views.py that allows remote, unauthenticated attackers to execute arbitrary commands. The panel's secMiddleware only enforces authentication on POST requests, so attackers can reach /dataBases/upgrademysqlstatus without credentials and inject shell metacharacters into the statusfile property, which the application passes to a shell. Successful exploitation yields arbitrary command execution on the server, effectively full control of the hosting panel and the websites it manages; versions through 2.3.6 and unpatched 2.3.7 are affected. Exploitation is active: the PSAUX group used this flaw in October 2024 to deploy ransomware on web hosting servers, and CISA added it to the Known Exploited Vulnerabilities catalog on 2024-11-07. A public proof-of-concept is available and EPSS places the 30-day exploitation probability at 86.5% (100th percentile).

What to do: Upgrade to a patched CyberPanel build that includes fix commit 5b08cd6 (a fully patched 2.3.7 or later release); if you cannot patch immediately, restrict access to /dataBases/upgrademysqlstatus or place the panel behind an access-control layer. Because exploitation is active and ransomware-related (PSAUX), check for compromise: review web/audit logs for unauthenticated requests to /dataBases/upgrademysqlstatus, look for unexpected processes, cron jobs, or ransomware artifacts, and per CISA apply vendor mitigations or discontinue use of the product.