CVE-2021-45466

What it actually does

CVE-2021-45466 is an unauthenticated authorization bypass in Control Web Panel before version 0.9.8.1107. A remote attacker can send a crafted request to the CWP API endpoint `api/?api=add_server&DHCP=` and cause an `authorized_keys` text file to be created under the `/resources/` directory. At minimum this is an unauthenticated arbitrary file-write condition in a web-accessible application path; depending on server configuration and follow-on actions, it may support persistence, credential/key planting, web content manipulation, or chaining into broader system compromise. The CVSS 9.8 rating reflects network reachability, no authentication requirement, low attack complexity, and potential full confidentiality, integrity, and availability impact.

Why it matters to the business

Exploitation can allow an external attacker to tamper with a hosting control panel without valid credentials. For organizations using Control Web Panel to administer web hosting, email, DNS, or server management functions, compromise of the panel can lead to service disruption, unauthorized server changes, hosted-site compromise, data exposure, and loss of administrative control. The vulnerability has public exploit availability and a high EPSS score, so internet-exposed CWP instances should be treated as high-priority even though it is not currently listed in CISA KEV.

How an attack unfolds

An attacker first identifies an internet-facing Control Web Panel instance running a vulnerable version earlier than 0.9.8.1107. The attacker then sends a crafted unauthenticated HTTP request to the CWP API using the `add_server` action and the `DHCP` parameter. Because the vulnerable API path fails to properly enforce authorization and validate the request, the application writes an attacker-controlled `authorized_keys` text file into the `/resources/` directory. The attacker can then verify whether the file was created by requesting the web-accessible resource path or by observing behavioral changes. After the file write succeeds, the attacker may use it as a persistence artifact, as part of an SSH-key planting workflow if the environment links or copies that file into an SSH context, or as a foothold for additional application-specific exploitation and control-panel abuse.

How to fix it

Upgrade Control Web Panel to version 0.9.8.1107 or later. If immediate upgrade is not possible, restrict access to the CWP administrative interface and API to trusted management networks or VPNs, block unauthenticated access to `/api/` paths at the reverse proxy or firewall, and add a temporary WAF rule to deny requests containing `api=add_server` with the `DHCP` parameter. Remove any unexpected `authorized_keys` files from CWP resource directories after investigation. Review all SSH authorized keys, CWP administrator accounts, API-related settings, and recently modified web resources for unauthorized changes. Restart affected CWP services after patching if required by the vendor update process.

How to confirm the fix worked

Confirm the installed Control Web Panel version is 0.9.8.1107 or later using the product update interface or local version files. Verify that the CWP API is not reachable from untrusted networks unless explicitly required. Test that unauthenticated requests to `api/?api=add_server&DHCP=` are rejected and do not create or modify files in the `/resources/` directory. Inspect the relevant resource directory for unexpected `authorized_keys` files or recent modification timestamps. Review web server, CWP, reverse proxy, and WAF logs to ensure requests matching the exploit pattern are blocked or absent after remediation.

Typical attack path

1. Scan for internet-exposed Control Web Panel services.
2. Fingerprint the CWP version or infer vulnerability from exposed behavior.
3. Send a crafted unauthenticated request to `api/?api=add_server&DHCP=`.
4. Cause creation or overwrite of an `authorized_keys` text file under the `/resources/` directory.
5. Check whether the file is retrievable or whether the panel behavior indicates the write succeeded.
6. Use the written file or resulting access to support persistence, privilege escalation, lateral movement, or further compromise of hosted services.

How to detect it

To determine whether exploitation already occurred, review CWP access logs, CWP error logs, web server logs, reverse proxy logs, WAF alerts, and network telemetry for unauthenticated requests to the API endpoint using `api=add_server` with a `DHCP` parameter. Common log locations may include CWP service logs under `/usr/local/cwpsrv/logs/`, web server access logs, reverse proxy logs, and centralized SIEM HTTP event sources. Investigate any successful HTTP 200/3xx responses associated with those requests, especially from unfamiliar external IP addresses. On disk, search for `authorized_keys` files under CWP web resource directories, especially any located under a `/resources/` path, and compare file ownership, permissions, contents, and modification times against deployment baselines. Also review standard SSH key locations such as `/root/.ssh/authorized_keys` and user `.ssh/authorized_keys` files for new or unfamiliar public keys added around the same time as suspicious CWP API requests. Correlate findings with SSH authentication logs, new CWP administrator accounts, configuration changes, service restarts, unexpected web files, and outbound network connections following the suspected exploitation time window.

• api/?api=add_server&DHCP=
• api=add_server&DHCP=
• api=add_server
• DHCP=
• /resources/authorized_keys
• authorized_keys
• /usr/local/cwpsrv/logs/access_log
• /usr/local/cwpsrv/logs/error_log
• /usr/local/cwpsrv/htdocs/resources/authorized_keys
• /root/.ssh/authorized_keys
• /.ssh/authorized_keys

What your security team should do

• Treat internet-facing vulnerable CWP instances as urgent remediation targets because public exploit code is available and EPSS indicates meaningful exploitation likelihood.
• Upgrade all Control Web Panel deployments to 0.9.8.1107 or later.
• Temporarily restrict CWP administrative and API access to trusted IP ranges, VPN, or a management network until patching is complete.
• Search historical logs for requests containing `api=add_server` and `DHCP=` to determine whether exploitation was attempted.
• Inspect CWP resource directories and SSH authorized-key locations for unauthorized `authorized_keys` content or recently modified key files.
• Rotate credentials and remove unauthorized administrator/API access if exploitation is suspected.
• Harden exposure by placing CWP behind MFA-capable access controls, reverse proxy allowlists, and monitoring rules for sensitive API endpoints.