Multiple Flaws in Control Web Panel Let Attacker Execute Code as Root on Linux Servers

Multiple Flaws in Control Web Panel Let Attacker Execute Code as Root on Linux Servers

Recently two critical vulnerabilities were detected by the cybersecurity analysts of Octagon Networks in the Control Web Panel (formerly also known as CentOS Web Panel) that is commonly known as CWP as well. Due to this bug, an attacker can easily execute code as root on Linux servers.

The CWP is a web hosting management software that is used by more than 200,000 unique servers, and it’s primarily found on cyber search engines like:

  • Shodan
  • Census

Flaws Detected

In total there are two critical vulnerabilities were detected, and they are:

  • CVE-2021-45467: Preauth remote command execution (RCE).
  • CVE-2021-45466: File write bug.

Exploitable

The threat actors can exploit these critical vulnerabilities in the CWP panel that are already exposed in the webroot without authentication.

There are two specific pages in which the experts have focused on for further analysis, and here they are:

  • /user/loader.php
  • /user/index.php
图片[1]|Multiple Flaws in Control Web Panel Let Attacker Execute Code as Root on Linux Servers|漏洞猎人基地

At this stage, an attacker needs to transform the include statement only to exploit the vulnerability and, from a remote resource inject malicious code remotely.

However, before the execution of the server, the included statement inserts the content of one PHP file into another PHP file to transform or alter it.

Here, the application will not process the input if the parameter “scripts” contains “..” (two dots); in short, in that case, by displaying the “hacking attempt” to the user it will exit.

Methods of bypassing

Here we have mentioned below all the potential bypassing methods:

  • Trick CWP to treat other characters as dot (.) 
  • Find unique characters the language C processes as a dot (.) when lowercased. 
  • Trick CWP into thinking there are no consecutive dots (..)

CWP pre-auth RCE chain

https://youtu.be/ibe66aUtThs

This could be executed by following three steps, and here we have mentioned them below:-

  • end a null byte powered file inclusion payload to add the malicious API key 
  • Use API key to write to a file (CVE-2021-45466)
  • Use step #1 to include the file we just wrote into (CVE-2021-45467)

Moreover, the file inclusion vulnerability (CVE-2021-45467) was already patched, but, the experts have affirmed that there are threat actors who successfully manage to reverse the patch to exploit servers.

© 版权声明
THE END
喜欢就支持一下吧
点赞9 分享
評論 抢沙发

请登录后发表评论

    请登录后查看评论内容