getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.

The CyberPanel installed on the remote host is affected by a remote code execution vulnerability. getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.

Note that Nessus has not tested for this issue and has relied only on the device's self-reported model number.

The CyberPanel installed on the remote host may be affected by a remote code execution vulnerability. getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.

Note that Nessus has not tested for this issue and has relied only on the device's self-reported model number.

CyberPanel version prior to 2.3.8 are affected by a vulnerability allowing an unauthenticated attacker to execute commands on the remote machine via a specially forged request.

ID	Name	Product	Family	Severity
242972	CyberPanel < 2.3.8 RCE Direct Check (CVE-2024-51378)	Nessus	Misc.	critical
242242	CyberPanel < 2.3.8 RCE (CVE-2024-51378)	Nessus	Misc.	critical
114469	CyberPanel < 2.3.8 Remote Command Execution	Web App Scanning	Component Vulnerability	critical

Detections

Analytics

CVE-2024-51378

critical

Tenable Plugins

critical

critical

critical