CyberPanel Remote Code Execution (RCE) and Authentication Bypass Vulnerability Advisory (CVE-2024-51378)
Executive & SecOps Summary
SECOPS ASSESSMENTCyberPanel versions through 2.3.6 and unpatched 2.3.7
Remote attackers can bypass authentication and execute arbitrary system commands with root privileges via shell metacharacters
Immediately upgrade CyberPanel to the latest commit (1c0c6cb or later) and restrict access to the management port
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Execute the official CyberPanel upgrade script to apply the latest security patches immediately.
# Run the official CyberPanel one-click upgrade script
sh <(curl -s https://raw.githubusercontent.com/usmannasir/cyberpanel/stable/preUpgrade.sh || wget -qO - https://raw.githubusercontent.com/usmannasir/cyberpanel/stable/preUpgrade.sh)2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, restrict access to the CyberPanel port (default: 8090) using UFW to allow only trusted IP addresses.
# Block public access to port 8090 and allow only a trusted administrator IP
sudo ufw deny 8090/tcp
sudo ufw allow from 192.168.1.100 to any port 8090 proto tcp
sudo ufw reload3. Log Audit & IoC Verification Commands
Scan the CyberPanel access logs for suspicious GET requests targeting the vulnerable endpoints containing shell metacharacters.
# Search for suspicious GET requests to getresetstatus containing shell metacharacters
grep -i 'getresetstatus' /home/cyberpanel/logs/access.log | grep -E '(\;|\||\`|\$)'Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability exists in the getresetstatus function within dns/views.py and ftp/views.py of CyberPanel. The root cause is two-fold: first, the security middleware (secMiddleware) is configured to validate authorization only for POST requests, allowing attackers to completely bypass authentication by sending GET requests to /dns/getresetstatus or /ftp/getresetstatus. Second, the application fails to sanitize the statusfile parameter, leading to an OS Command Injection vulnerability (CWE-78) when the parameter is passed to shell execution functions.
2. Exploitation Mechanics & Attack Scenario
An attacker sends a crafted HTTP GET request targeting /dns/getresetstatus or /ftp/getresetstatus. By appending shell metacharacters (such as ;, |, or ` `) along with malicious commands inside the statusfile` query parameter, the attacker bypasses the authentication middleware. The backend processes this parameter directly within a system shell context, executing the injected commands under the privileges of the web server process (typically root). This vulnerability has been actively exploited in the wild by threat actors such as PSAUX since October 2024.
3. Infrastructure & Business Impact
With a CVSS score of 9.8 (Critical) and its inclusion in the CISA KEV catalog, this vulnerability poses an extreme risk. Successful exploitation allows complete takeover of the hosting server, enabling attackers to exfiltrate databases, deploy ransomware, deface hosted websites, or pivot into internal networks.
Official Vendor Advisories & References
getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.
Frequently Asked SecOps Questions (CVE-2024-51378)
FAQQ1. How critical is CVE-2024-51378 and is it actively exploited in the wild?
CVE-2024-51378 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 94.8%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2024-51378?
Primary impacted vendors include cyberpanel across cyberpanel. Scope summary: CyberPanel versions through 2.3.6 and unpatched 2.3.7
Q3. What temporary mitigations or workarounds exist for CVE-2024-51378 before patching?
[Mitigation] Immediately upgrade CyberPanel to the latest commit (1c0c6cb or later) and restrict access to the management port Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2024-51378
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (cyberpanel)
View Category →LiteLLM Proxy Server MCP Test Endpoints Remote Code Execution Vulnerability Advisory (CVE-2026-42271)
[Affected Scope] LiteLLM proxy server environments running versions 1.74.2 to before 1.83.7
Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
Critical RCE in Nextcloud Collabora Online Built-in CODE Server (CVE-2026-110447)
[Affected Scope] Collabora Online Built-in CODE Server (richdocumentscode) for Nextcloud before version 26.4.303.
BeyondTrust Remote Support and Privileged Remote Access Pre-Authentication Remote Code Execution (RCE) Vulnerability (CVE-2026-1731) Urgent Security Advisory
[Affected Scope] BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA).
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.