CVE-2024-51378: cyberpanel

csirt@kutim:~/threat-intel/cve/CVE-2024-51378

CVSS 9.8 · Critical KEV · sudah dieksploitasi Dipakai ransomware EPSS 94,7%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada cyberpanel. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 4 Desember 2024, artinya sudah terbukti dieksploitasi. Tercatat dipakai dalam kampanye ransomware.

Deskripsi (NVD)

getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.

Rincian

Terbit di NVD: 29 Oktober 2024
Terakhir diubah: 5 Agustus 2026
Status NVD: Analyzed
CVSS 3.1: 9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
EPSS (30 hari): 94,7% peluang dieksploitasi; lebih tinggi dari 99,8% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama: CyberPanel Incorrect Default Permissions Vulnerability
Masuk KEV: 4 Desember 2024
Tenggat CISA: 25 Desember 2024 (untuk instansi federal AS)
Ransomware: Tercatat dipakai dalam kampanye ransomware
Tindakan wajib: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
cyberpanel	cyberpanel	Semua versi sebelum 2.3.8

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/usmannasir/cyberpanel/commit/1c0c6cbcf71abe573da0b5fddfb9603e7477f683 patch
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-51378 pemerintah AS
https://refr4g.github.io/posts/cyberpanel-command-injection-vulnerability/ exploit
https://www.bleepingcomputer.com/news/security/massive-psaux-ransomware-attack-targets-22-000-cyberpanel-insta... exploit · press/media coverage
https://cwe.mitre.org/data/definitions/420.html not applicable
https://cwe.mitre.org/data/definitions/78.html not applicable
https://cyberpanel.net/KnowledgeBase/home/change-logs/ release notes
https://cyberpanel.net/blog/detials-and-fix-of-recent-security-issue-and-patch-of-cyberpanel product

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.