CyberPanel Incorrect Default Permissions Vulnerability (CVE-2024-51567)
Published In CISA KEV since Sources: pwn.watch, CVE.org
What is affected, what to do
The vulnerability CVE-2024-51567 allows remote code execution (RCE) by bypassing authentication due to incorrect default permissions in CyberPanel. An unauthenticated attacker can execute commands as root, gaining full control of the system. This vulnerability is actively exploited in ransomware campaigns since October 2024. Affected are CyberPanel versions up to and including 2.3.7. An immediate update to version 2.3.8 is critical to mitigate the risk.
The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. Update CyberPanel to version 2.3.8. Immediate actions, mitigation and detection rules are in the runbook below.
- Affected
- CyberPanel
lt *..2.3.8
- CyberPanel
- Fixed in
- CyberPanel
2.3.8
- CyberPanel
Not sure whether and how you are affected? Ask a question about this vulnerability
Metrics
10.0
Priority
XIEM Effective CVSS: highest available CVSS rating from NVD and vendor data.
Source: NVD, CVSS v3
10.0
CVSS v3
Severity Critical on the scale from 0 to 10.
Source: pwn.watch, CVE.org
84.4 %
EPSS score
High — model estimates ≥ 50% chance of real-world exploitation within 30 days.
Source: FIRST EPSS, percentile 99.70
Show all metrics
- Severity
- Critical
Priority (0–325)
The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first?
Read in glossary- 261.25 Methodology
Exploit maturity
An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack.
Read in glossary- actively exploitedSource: VulnCheck KEV (opens in a new tab) How we classify
XIEM Effective CVSS
XIEM® is the tiered managed-security operating model from NEOSEC and a registered trademark of NEOSEC GmbH. It extends classic SIEM — the central collection, normalisation and correlation of security-relevant events — with endpoint forensics, network visibility and deception technology, and consolidates them into three building tiers: Sentry, Orchestrate and Command.
Read in glossary- 10.0 Methodology
CVSS v3
CVSS is the globally established, open standard for assessing the technical severity of a vulnerability on a scale from 0 to 10. It describes how easily a flaw can be exploited and what damage it can cause — but not how likely its actual exploitation is. CVSS and the complementary EPSS deliberately answer different questions.
Read in glossary- 10.0
EPSS score
The EPSS score is the absolute model output for an individual vulnerability: the estimated probability of real-world exploitation within the next 30 days, expressed as a value between 0 and 1 (i.e. 0 % to 100 %). A score of 0.42 means „the model estimates a 42 % chance of real-world exploitation within 30 days“.
Read in glossary- 84.4 %
- High — model estimates ≥ 50% chance of real-world exploitation within 30 days.
EPSS percentile
The EPSS percentile is the relative position of a vulnerability within all EPSS-scored CVEs, expressed as a value between 0 and 1. A percentile of 0.90 means „this CVE has a higher EPSS score than 90 % of all other scored CVEs“. Unlike the EPSS score, it is not a probability — but a positioning within a ranking.
Read in glossary- 99.70
- Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
KEV status
The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.
Read in glossary- Actively exploited
- Published
In CISA KEV since
The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.
Read in glossary
Response and mitigation
Why act now?
Prioritisation rationale
This CVE is on KEV because it hands an unauthenticated remote attacker root-level command execution with no user interaction and a trivially crafted HTTP request. Active abuse by the PSAUX ransomware operation combined with a very high exploitation likelihood makes every internet-facing CyberPanel instance an emergency-patch item that outranks almost everything else in the backlog. Typical victims are hosters, MSPs and smaller shops using CyberPanel as a cheap cPanel alternative — often with many tenants on one VM, which multiplies the blast radius of a ransomware event. NIS2-regulated organisations with CyberPanel anywhere in their hosting stack (including at subsidiaries or outsourced providers) should inventory immediately, patch or decommission, and prepare incident-notification workflows under their national NIS2 transposition.
Runbook step 1
Immediate response (0-24 h)
- Upgrade CyberPanel to commit 5b08cd6 or later (upstream repository: usmannasir/cyberpanel). Everything up to 2.3.6 and the initial 2.3.7 release is vulnerable; 2.3.8 ships the fix. Until the upgrade is in place, remove the admin panel (default TCP port 8090) from the public internet at the perimeter firewall.
- Assume compromise for any instance that was internet-reachable between October 2024 and the patch date. PSAUX ransomware is actively weaponising this bug, so exposed hosts need to be taken offline, imaged forensically, and triaged — not just patched in place.
- Rotate every credential the host touches: MySQL root and tenant DB accounts, SSH keys under /root/.ssh and /home/*/.ssh, API tokens from /usr/local/CyberCP, the LiteSpeed/OpenLiteSpeed admin password, and all tenant mail and FTP accounts.
- Hunt for persistence: review /etc/cron., /var/spool/cron/, systemd units in /etc/systemd/system/, and root's shell rc files for newly added entries. Flag base64 payloads, kinsing/XMRig-style binaries, and outbound connections to mining pools.
- If upgrading is organisationally blocked, place a reverse proxy (nginx/HAProxy) in front of CyberPanel and block /dataBases/upgrademysqlstatus for any HTTP method — secMiddleware only guards POST, so GET requests slip past authentication entirely.
Runbook step 2
Mitigation layers
- Network segmentation: move CyberPanel hosts into a dedicated management VLAN, reachable on port 8090 only through a VPN or MFA-protected bastion. No direct internet exposure of the admin panel, not even "just briefly for testing".
- Reverse-proxy rule in front of CyberPanel: drop or add Basic Auth to every request hitting /dataBases/upgrademysqlstatus regardless of HTTP verb, and extend the same treatment to other unprotected endpoints under /dataBases/ until the patch is verified.
- WAF/IPS signature: pattern-match on the statusfile parameter containing shell metacharacters (;, |, &&, backtick, $(, backslash-x escapes) in body or query string. Suricata rule shape: alert http any any -> $CYBERPANEL any (content:"upgrademysqlstatus"; http_uri; pcre:"/statusfile=[^&]*[;|&\x60$]/"; sid:1000001;).
- OS hardening: enforce an AppArmor or SELinux profile around the gunicorn/CyberCP process so shell spawns (/bin/sh, /bin/bash) from the Python context are audited or denied. Mount /tmp and /var/tmp with noexec.
- Egress filtering: restrict outbound traffic from the CyberPanel host to a known-good allowlist (OS repos, Let's Encrypt, SMTP relay). PSAUX payloads pull second-stage tooling over HTTP(S); a default-deny egress policy cuts that chain cleanly.
- Verify offline backups of tenant data (mailboxes, web roots, DB dumps) before starting cleanup. Ransomware use is confirmed, not hypothetical.
Runbook step 3
Detection rules
- Web access logs (OpenLiteSpeed/nginx fronting CyberPanel): any GET or PUT to /dataBases/upgrademysqlstatus is suspicious by design — the legitimate flow is POST from the admin UI. KQL shape:
WebLogs | where UriPath contains "upgrademysqlstatus" and HttpMethod != "POST". - Process telemetry (auditd / Sysmon-for-Linux EID 1): child processes of gunicorn, python3 or lscpd whose image is /bin/sh, /bin/bash, wget, curl, perl or python with base64/eval arguments. Sigma shape: parent_image ends with gunicorn, child_image in shell list, command_line matches
(curl|wget).*(\.sh|/tmp/). - auditd rule for execve carrying shell metacharacters in argv, invoked by the CyberCP service user:
-a always,exit -F arch=b64 -S execve -F uid=cyberpanel -k cyberpanel_rce. - Network telemetry (Zeek http.log / Suricata): outbound HTTP downloads from the CyberPanel host within seconds of an inbound request to /dataBases/upgrademysqlstatus — temporal correlation under five seconds is a strong IOC. Cross-reference PSAUX IOCs from public feeds (e.g. AlienVault OTX pulses).
- File-integrity monitoring: alert on newly executable files in /tmp, /var/tmp, /dev/shm, and on changes to /etc/crontab, /etc/cron.d/* and /root/.ssh/authorized_keys. Any baseline deviation triggers incident response.
- Web access logs (OpenLiteSpeed/nginx fronting CyberPanel): any GET or PUT to /dataBases/upgrademysqlstatus is suspicious by design — the legitimate flow is POST from the admin UI. KQL shape:
Detection rules
No NEOSEC detection rule is available for this vulnerability yet.
Classification under NIS2 and CRA
Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.
NIS2
NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.
Read in glossary- Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).
CRA
The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.
Read in glossary- Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.
ISO/IEC 27001
ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.
Read in glossary- Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.
Description
upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.
Source: pwn.watch, CISA KEV Catalog, cvelistv5, NVD (NIST), CVE.org (MITRE)
Affected products
The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.
| Affected versions | Fixed in | ||
|---|---|---|---|
| cyberpanel | cyberpanel |
|
|
Vendors and products
Public exploit references
Publicly reported proof-of-concepts, exploit modules and detection templates for this vulnerability. NEOSEC links to the original sources only and does not provide any exploit code.
| CISA KEV Catalog | CISA Known Exploited Vulnerability (opens in a new tab)cisa.gov | actively exploited |
References & sources
- cwe.mitre.orgdata/definitions/78.html
- dreyand.rscode/review/2024/10/27/what-are-my-options-cyberpanel-v236-pre-…
- github.comusmannasir/cyberpanel/commit/5b08cd6d53f4dbc2107ad9f555122ce8b0…
- cyberpanel.netCyberPersons advisory: CVE-2024-51378pwn-watch
- cwe.mitre.orgdata/definitions/420.html
- cyberpanel.netCyberPersons advisory: CVE-2024-51567pwn-watch
- bleepingcomputer.comnews/security/massive-psaux-ransomware-attack-targets-22-000-cy…
- cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2024-51567government-resource
- pwn.watchpwn.watch: CyberPersons CyberPanel: 2 actively exploited vulnerabilitiespwn-watch
- NVD (NIST)NVD: CVE-2024-51567pwn-watch
- NVD (NIST)NVD: CVE-2024-51378pwn-watch
- cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch
Embed badge
Show the severity and KEV status of this vulnerability on your site – with a link back here. The image is updated hourly.
<a href="https://intel.neosec.eu/en/cve/CVE-2024-51567"><img src="https://intel.neosec.eu/badge/cve/CVE-2024-51567.svg?lang=en" alt="CVE-2024-51567 – NEOSEC Intel" height="20"></a>