CyberPanel Remote Code Execution (RCE) and Authentication Bypass Vulnerability Advisory (CVE-2024-51567)

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2024-51567) exists in the upgrademysqlstatus endpoint within databases/views.py of CyberPanel. The root cause is twofold: first, the security middleware (secMiddleware) is configured to validate authentication and authorization exclusively for HTTP POST requests, allowing attackers to bypass access controls by utilizing other HTTP methods (CWE-306). Second, the endpoint processes the statusfile parameter without proper sanitization, passing it directly to a system shell, which leads to an OS Command Injection vulnerability (CWE-78).

2. Exploitation Mechanics & Attack Scenario

An unauthenticated attacker sends a crafted HTTP request targeting the /dataBases/upgrademysqlstatus endpoint. By exploiting the flaw where secMiddleware only filters POST requests, the attacker bypasses authentication checks. The attacker then injects shell metacharacters (such as ;, &&, or |) followed by malicious commands into the statusfile property. Because the backend executes this input directly in a shell context, the injected commands run with the privileges of the CyberPanel process (typically root), enabling complete remote takeover. This vulnerability has been actively exploited in the wild, notably by threat actors such as PSAUX in October 2024.

3. Infrastructure & Business Impact

With a CVSS score of 9.8 (Critical) and its inclusion in the CISA KEV catalog, this vulnerability poses an extreme risk. Successful exploitation grants full administrative control over the host server. This can lead to complete database compromise, deployment of ransomware, unauthorized access to hosted websites, and lateral movement within the internal network, resulting in severe business disruption and data breaches.