Wednesday, May 7, 2025
HomeLinuxMultiple Flaws in Control Web Panel Let Attacker Execute Code as Root...

Multiple Flaws in Control Web Panel Let Attacker Execute Code as Root on Linux Servers

Published on

SIEM as a Service

Follow Us on Google News

Recently two critical vulnerabilities were detected by the cybersecurity analysts of Octagon Networks in the Control Web Panel (formerly also known as CentOS Web Panel) that is commonly known as CWP as well. Due to this bug, an attacker can easily execute code as root on Linux servers.

The CWP is a web hosting management software that is used by more than 200,000 unique servers, and it’s primarily found on cyber search engines like:-

  • Shodan
  • Census

Flaws Detected

In total there are two critical vulnerabilities were detected, and they are:-

- Advertisement - Google News
  • CVE-2021-45467: Preauth remote command execution (RCE).
  • CVE-2021-45466: File write bug.

Exploitable

The threat actors can exploit these critical vulnerabilities in the CWP panel that are already exposed in the webroot without authentication.

There are two specific pages in which the experts have focused on for further analysis, and here they are:-

  • /user/loader.php
  • /user/index.php

At this stage, an attacker needs to transform the include statement only to exploit the vulnerability and, from a remote resource inject malicious code remotely.

However, before the execution of the server, the included statement inserts the content of one PHP file into another PHP file to transform or alter it.

Here, the application will not process the input if the parameter “scripts” contains “..” (two dots); in short, in that case, by displaying the “hacking attempt” to the user it will exit.

Methods of bypassing

Here we have mentioned below all the potential bypassing methods:-

  • Trick CWP to treat other characters as dot (.) 
  • Find unique characters the language C processes as a dot (.) when lowercased. 
  • Trick CWP into thinking there are no consecutive dots (..)

CWP pre-auth RCE chain

This could be executed by following three steps, and here we have mentioned them below:-

  • end a null byte powered file inclusion payload to add the malicious API key 
  • Use API key to write to a file (CVE-2021-45466)
  • Use step #1 to include the file we just wrote into (CVE-2021-45467)

Moreover, the file inclusion vulnerability (CVE-2021-45467) was already patched, but, the experts have affirmed that there are threat actors who successfully manage to reverse the patch to exploit servers.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates

Latest articles

BFDOOR Malware Targets Organizations to Establish Long-Term Persistence

The BPFDoor malware has emerged as a significant threat targeting domestic and international organizations,...

Uncovering the Security Risks of Data Exposure in AI-Powered Tools like Snowflake’s CORTEX

As artificial intelligence continues to reshape the technological landscape, tools like Snowflake’s CORTEX Search...

UNC3944 Hackers Shift from SIM Swapping to Ransomware and Data Extortion

UNC3944, a financially-motivated threat actor also linked to the group known as Scattered Spider,...

Over 2,800 Hacked Websites Targeting MacOS Users with AMOS Stealer Malware

Cybersecurity researcher has uncovered a massive malware campaign targeting MacOS users through approximately 2,800...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

New ClickFix Attack Imitates Ministry of Defence Website to Target Windows & Linux Systems

A newly identified cyberattack campaign has surfaced, leveraging the recognizable branding of India's Ministry...

Outlaw Cybergang Launches Global Attacks on Linux Environments with New Malware

The Outlaw cybergang, also known as “Dota,” has intensified its global assault on Linux...

Malicious npm Packages Target Linux Developers with SSH Backdoor Attacks

In a sophisticated onslaught targeting the open-source ecosystem, reports have emerged detailing several malicious...