Monday, November 4, 2024
HomeLinuxMultiple Flaws in Control Web Panel Let Attacker Execute Code as Root...

Multiple Flaws in Control Web Panel Let Attacker Execute Code as Root on Linux Servers

Published on

Malware protection

Recently two critical vulnerabilities were detected by the cybersecurity analysts of Octagon Networks in the Control Web Panel (formerly also known as CentOS Web Panel) that is commonly known as CWP as well. Due to this bug, an attacker can easily execute code as root on Linux servers.

The CWP is a web hosting management software that is used by more than 200,000 unique servers, and it’s primarily found on cyber search engines like:-

  • Shodan
  • Census

Flaws Detected

In total there are two critical vulnerabilities were detected, and they are:-

- Advertisement - SIEM as a Service
  • CVE-2021-45467: Preauth remote command execution (RCE).
  • CVE-2021-45466: File write bug.

Exploitable

The threat actors can exploit these critical vulnerabilities in the CWP panel that are already exposed in the webroot without authentication.

There are two specific pages in which the experts have focused on for further analysis, and here they are:-

  • /user/loader.php
  • /user/index.php

At this stage, an attacker needs to transform the include statement only to exploit the vulnerability and, from a remote resource inject malicious code remotely.

However, before the execution of the server, the included statement inserts the content of one PHP file into another PHP file to transform or alter it.

Here, the application will not process the input if the parameter “scripts” contains “..” (two dots); in short, in that case, by displaying the “hacking attempt” to the user it will exit.

Methods of bypassing

Here we have mentioned below all the potential bypassing methods:-

  • Trick CWP to treat other characters as dot (.) 
  • Find unique characters the language C processes as a dot (.) when lowercased. 
  • Trick CWP into thinking there are no consecutive dots (..)

CWP pre-auth RCE chain

This could be executed by following three steps, and here we have mentioned them below:-

  • end a null byte powered file inclusion payload to add the malicious API key 
  • Use API key to write to a file (CVE-2021-45466)
  • Use step #1 to include the file we just wrote into (CVE-2021-45467)

Moreover, the file inclusion vulnerability (CVE-2021-45467) was already patched, but, the experts have affirmed that there are threat actors who successfully manage to reverse the patch to exploit servers.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates

Latest articles

Evasive Panda Attacking Cloud Services To Steal Data Using New Toolkit

The Evasive Panda group deployed a new C# framework named CloudScout to target a...

Massive Midnight Blizzard Phishing Attack Using Weaponized RDP Files

Researchers warn of ongoing spear-phishing attacks by Russian threat actor Midnight Blizzard targeting individuals...

Sophisticated Phishing Attack Targeting Ukraine Military Sectors

The Ukrainian Cyber Emergency Response Team discovered a targeted phishing campaign launched by UAC-0215...

Chinese Hackers Attacking Microsoft Customers With Sophisticated Password Spray Attacks

Researchers have identified a network of compromised devices, CovertNetwork-1658, used by Chinese threat actors...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

10 Best Linux Distributions In 2024

The Linux Distros is generally acknowledged as the third of the holy triplet of...

Linux Malware perfctl Attacking Millions of Linux Servers

Researchers have uncovered a sophisticated Linux malware, dubbed "perfctl," actively targeting millions of Linux...

Earth Lusca Using Multiplatform Backdoor to Attack Windows & Linux Machines

Earth Lusca is a suspected China-based cyber espionage group active since at least April...