Sunday, May 19, 2024

Multiple Flaws in Control Web Panel Let Attacker Execute Code as Root on Linux Servers

Recently two critical vulnerabilities were detected by the cybersecurity analysts of Octagon Networks in the Control Web Panel (formerly also known as CentOS Web Panel) that is commonly known as CWP as well. Due to this bug, an attacker can easily execute code as root on Linux servers.

The CWP is a web hosting management software that is used by more than 200,000 unique servers, and it’s primarily found on cyber search engines like:-

  • Shodan
  • Census

Flaws Detected

In total there are two critical vulnerabilities were detected, and they are:-

  • CVE-2021-45467: Preauth remote command execution (RCE).
  • CVE-2021-45466: File write bug.

Exploitable

The threat actors can exploit these critical vulnerabilities in the CWP panel that are already exposed in the webroot without authentication.

There are two specific pages in which the experts have focused on for further analysis, and here they are:-

  • /user/loader.php
  • /user/index.php

At this stage, an attacker needs to transform the include statement only to exploit the vulnerability and, from a remote resource inject malicious code remotely.

However, before the execution of the server, the included statement inserts the content of one PHP file into another PHP file to transform or alter it.

Here, the application will not process the input if the parameter “scripts” contains “..” (two dots); in short, in that case, by displaying the “hacking attempt” to the user it will exit.

Methods of bypassing

Here we have mentioned below all the potential bypassing methods:-

  • Trick CWP to treat other characters as dot (.) 
  • Find unique characters the language C processes as a dot (.) when lowercased. 
  • Trick CWP into thinking there are no consecutive dots (..)

CWP pre-auth RCE chain

This could be executed by following three steps, and here we have mentioned them below:-

  • end a null byte powered file inclusion payload to add the malicious API key 
  • Use API key to write to a file (CVE-2021-45466)
  • Use step #1 to include the file we just wrote into (CVE-2021-45467)

Moreover, the file inclusion vulnerability (CVE-2021-45467) was already patched, but, the experts have affirmed that there are threat actors who successfully manage to reverse the patch to exploit servers.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates

Website

Latest articles

Norway Recommends Replacing SSLVPN/WebVPN to Stop Cyber Attacks

A very important message from the Norwegian National Cyber Security Centre (NCSC) says that...

New Linux Backdoor Attacking Linux Users Via Installation Packages

Linux is widely used in numerous servers, cloud infrastructure, and Internet of Things devices,...

ViperSoftX Malware Uses Deep Learning Model To Execute Commands

ViperSoftX malware, known for stealing cryptocurrency information, now leverages Tesseract, an open-source OCR engine,...

Santander Data Breach: Hackers Accessed Company Database

Santander has confirmed that there was a major data breach that affected its workers...

U.S. Govt Announces Rewards up to $5 Million for North Korean IT Workers

The U.S. government has offered a prize of up to $5 million for information...

Russian APT Hackers Attacking Critical Infrastructure

Russia leverages a mix of state-backed Advanced Persistent Threat (APT) groups and financially motivated...

Millions Of IoT Devices Vulnerable To Attacks Leads To Full Takeover

Researchers discovered four significant vulnerabilities in the ThroughTek Kalay Platform, which powers 100 million...

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles