[0day-rubbish] CloudPanel 2.5.4-3 site-settings rootDirectory nginx virtual-host injection to host root code execution (8.8)
CloudPanel 2.5.4-3 site settings can inject an nginx vhost and run code as root.
A disclosure covers CloudPanel Community Edition 2.5.4-3+clp-bookworm, the closed-source server-management panel from cloudpanel.io in Germany. The Symfony application on port 8443 supervises nginx, PHP-FPM, MariaDB and hosted sites. Setting rootDirectory in site settings injects an nginx virtual host that yields root code execution on the host. The vendor package is identified by size and MD5, and the flaw is scored 8.8.
- Site-settings rootDirectory value injects an nginx virtual host.
- Injection leads to code execution as root on the panel host.
- Affects CloudPanel Community Edition 2.5.4-3; scored 8.8.
- Vendors
- cloudpanel.io
- Products
- CloudPanel
- Organizations
- 0day Rubbish Research Team
- Countries
- Germany
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 24c36a4739ce065c5c188c89def06f29 | he vendor's own distribution package, 69,183,476 bytes, md5 24c36a4739ce065c5c188c89def06f29, on... |
From the original article
Posted by disclosure via Fulldisclosure on Oct 15 0day Rubbish Research Team is publicly disclosing a vulnerability in CloudPanel Community Edition 2. 5. 4-3+clp-bookworm, the closed-source server-management panel from cloudpanel.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.