Recently two critical vulnerabilities were detected by the cybersecurity analysts of Octagon Networks in the Control Web Panel (formerly also known as CentOS Web Panel) that is commonly known as CWP as well. Due to this bug, an attacker can easily execute code as root on Linux servers.

The CWP is a web hosting management software that is used by more than 200,000 unique servers, and it’s primarily found on cyber search engines like:

• Shodan
• Census

Flaws Detected

In total there are two critical vulnerabilities were detected, and they are:

• CVE-2021-45467: Preauth remote command execution (RCE).
• CVE-2021-45466: File write bug.

Exploitable

The threat actors can exploit these critical vulnerabilities in the CWP panel that are already exposed in the webroot without authentication.

There are two specific pages in which the experts have focused on for further analysis, and here they are:

• /user/loader.php
• /user/index.php

At this stage, an attacker needs to transform the include statement only to exploit the vulnerability and, from a remote resource inject malicious code remotely.

However, before the execution of the server, the included statement inserts the content of one PHP file into another PHP file to transform or alter it.

Here, the application will not process the input if the parameter “scripts” contains “..” (two dots); in short, in that case, by displaying the “hacking attempt” to the user it will exit.

Methods of bypassing

Here we have mentioned below all the potential bypassing methods:

• Trick CWP to treat other characters as dot (.) 
• Find unique characters the language C processes as a dot (.) when lowercased. 
• Trick CWP into thinking there are no consecutive dots (..)

CWP pre-auth RCE chain

https://youtu.be/ibe66aUtThs

This could be executed by following three steps, and here we have mentioned them below:-

• end a null byte powered file inclusion payload to add the malicious API key 
• Use API key to write to a file (CVE-2021-45466)
• Use step #1 to include the file we just wrote into (CVE-2021-45467)

Moreover, the file inclusion vulnerability (CVE-2021-45467) was already patched, but, the experts have affirmed that there are threat actors who successfully manage to reverse the patch to exploit servers.