CVE-2024-51378

What is CyberPanel?

CyberPanel is an open-source web hosting control panel. See CVE-2024-51567 for the full product context on the October 2024 mass exploitation event.

Overview

CVE-2024-51378 is an OS command injection vulnerability (CWE-78) in CyberPanel that is the second of two simultaneous CVSS 10.0 vulnerabilities exploited in the October 2024 mass PSAUX ransomware attack alongside CVE-2024-51567. Where CVE-2024-51567 exploits missing authentication on the upgrademysqlstatus endpoint, CVE-2024-51378 exploits shell metacharacter injection in the statusfile property, also allowing unauthenticated root command execution. CISA added this CVE to the KEV catalog one month after CVE-2024-51567, suggesting it was confirmed as an additional exploitation vector used in the same campaign.

Affected Versions

Technical Details

The OS command injection (CWE-78) occurs in CyberPanel's statusfile property handling. Similar to CVE-2024-51567, insufficient authentication and input sanitization allows an unauthenticated attacker to inject shell metacharacters through the statusfile parameter of an API endpoint. The injected commands execute in the context of the CyberPanel process, which runs as root.

Attack characteristics:

• Unauthenticated — no credentials required (incorrect default permissions)
• Shell metacharacters injected via the statusfile property bypass authentication and execute commands
• Commands run as root with access to all hosted websites, databases, and system resources

Relationship to CVE-2024-51567: Both vulnerabilities were exploited simultaneously in the October 2024 PSAUX ransomware campaign. They represent two distinct injection paths in the same CyberPanel codebase — attackers likely used whichever path worked against each target's specific configuration or CyberPanel version. The one-month delay between CISA KEV listings (Nov 7 for 51567, Dec 4 for 51378) reflects that 51378's exploitation was confirmed separately from the initial wave.

Exploitation Context

Part of the same PSAUX ransomware mass exploitation campaign that compromised ~22,000 CyberPanel servers in October 2024. See CVE-2024-51567 for the full exploitation context including timeline, scale, and ransomware details.

Remediation

1. Upgrade CyberPanel to 2.3.8 — patches both CVE-2024-51567 and CVE-2024-51378 simultaneously. The CISA deadline was December 25, 2024.
2. Restrict CyberPanel to non-internet-facing access via IP allowlisting or VPN.
3. Scan for PSAUX ransomware, cryptominers, and webshells on all hosted sites.
4. See CVE-2024-51567 for full remediation guidance applicable to both CVEs.