CVE-2024-51378

What it actually does

The flaw is an unauthenticated command injection in CyberPanel's getresetstatus handlers in dns/views.py and ftp/views.py. The affected endpoints, /dns/getresetstatus and /ftp/getresetstatus, can be reached in a way that bypasses secMiddleware because the middleware protection is applied only to POST handling. An attacker can supply shell metacharacters in the statusfile property, causing the application to pass attacker-controlled input to the operating system shell and execute arbitrary commands with the privileges of the CyberPanel web application process. CyberPanel versions through 2.3.6 and unpatched 2.3.7 are affected; the upstream fix is associated with commit 1c0c6cb. The vulnerability is listed in CISA KEV, has a critical CVSS score of 9.8, a very high EPSS probability of 0.94734, and has been exploited in the wild, including ransomware-related activity.

Why it matters to the business

A vulnerable internet-exposed CyberPanel instance can be taken over without valid credentials. Successful exploitation can let attackers install malware, deploy ransomware, steal hosted website and database credentials, modify DNS or FTP-related configuration, create persistence, pivot to hosted sites or adjacent systems, and disrupt web hosting operations. Because this issue is confirmed exploited in the wild, associated with ransomware campaigns, and the CISA KEV remediation date of 2024-12-25 has passed, unpatched systems should be treated as high-priority incident-response candidates rather than routine patching items.

How an attack unfolds

An attacker first identifies a CyberPanel instance exposed over HTTP or HTTPS. They then send a crafted unauthenticated request to /dns/getresetstatus or /ftp/getresetstatus using a method or request path that avoids the intended secMiddleware enforcement. The attacker includes a malicious statusfile value containing shell metacharacters. When CyberPanel processes the request, the vulnerable getresetstatus code passes that value into shell execution logic, allowing the attacker-supplied command to run on the server. In observed real-world exploitation, attackers used this access to stage payloads, run download-and-execute commands, and establish follow-on access. Because exploitation does not require authentication and the affected endpoints are predictable, scanning and mass exploitation are practical, especially against hosting panels exposed directly to the internet.

How to fix it

Upgrade CyberPanel to a version that includes the upstream fix for commit 1c0c6cb or a later vendor-supported release. CyberPanel versions through 2.3.6 and unpatched 2.3.7 should be considered vulnerable. If immediate upgrade is not possible, remove CyberPanel from direct internet exposure, restrict access to trusted administrative IP ranges through a firewall or VPN, block requests to /dns/getresetstatus and /ftp/getresetstatus at the reverse proxy or WAF, and disable unused DNS/FTP panel functionality where feasible. Because this vulnerability has been actively exploited, patching alone is not sufficient for exposed systems: review for compromise, remove malicious artifacts, rotate CyberPanel, FTP, SSH, database, API, and hosting credentials, and rebuild from known-good media if there are signs of attacker persistence. The supplied package fixed-version data also lists Ubuntu database package updates: mariadb-5.5 on Ubuntu 14.04 LTS fixed in 5.5.53-1ubuntu0.14.04.1, mysql-5.5 on Ubuntu 14.04 LTS fixed in 5.5.53-0ubuntu0.14.04.1, and mariadb-10.0 on Ubuntu 16.04 LTS fixed in 10.0.28-0ubuntu0.16.04.1; apply those OS package updates where those packages are present, but do not treat them as a substitute for patching CyberPanel itself.

How to confirm the fix worked

Confirm the installed CyberPanel version and build contain the upstream fix for the getresetstatus handlers. Review dns/views.py and ftp/views.py to verify that the vulnerable statusfile shell handling has been removed or safely constrained and that authentication/middleware checks are enforced consistently for all relevant HTTP methods. From an unauthenticated network location, verify that /dns/getresetstatus and /ftp/getresetstatus are not reachable without authentication and do not process statusfile input. Use only benign validation requests; do not run destructive command-injection tests on production systems. Validate external exposure with vulnerability scanners, web server access-log searches, and perimeter inventory. If compensating controls are used, confirm the firewall, VPN, reverse proxy, or WAF blocks unauthenticated access to the vulnerable paths before traffic reaches CyberPanel.

Typical attack path

1. Scan the internet or target ranges for exposed CyberPanel services.
2. Probe for /dns/getresetstatus and /ftp/getresetstatus availability.
3. Send an unauthenticated request that bypasses middleware assumptions around request method handling.
4. Inject shell metacharacters through the statusfile parameter.
5. Execute an initial command to verify code execution or retrieve a second-stage payload.
6. Download and run malware, web shells, cryptocurrency miners, ransomware tooling, or remote access agents.
7. Create persistence through cron jobs, SSH keys, new users, modified startup scripts, or application-level backdoors.
8. Access hosted website files, FTP data, DNS configuration, database credentials, or control panel secrets.
9. Use the compromised server for lateral movement, data theft, spam, phishing, botnet activity, or ransomware deployment.

How to detect it

To determine whether exploitation already occurred, review HTTP access logs from CyberPanel, nginx, Apache, reverse proxies, load balancers, and WAFs for requests to /dns/getresetstatus or /ftp/getresetstatus, especially unauthenticated requests, nonstandard methods, URL-encoded metacharacters, and statusfile parameters containing command separators, pipes, backticks, dollar-parentheses, redirection, or download commands. Correlate suspicious web requests with host telemetry showing child processes spawned by the CyberPanel web process, such as /bin/sh, bash, curl, wget, python, perl, php, chmod, chattr, or systemctl. Examine EDR and audit logs for outbound network connections immediately after requests to the affected endpoints. Review filesystem changes under CyberPanel application directories, web roots, /tmp, /var/tmp, /dev/shm, cron locations, systemd unit directories, SSH authorized_keys files, and user account files. Check authentication logs for new users, unexpected SSH logins, privilege escalation, and failed or successful logins after the suspected exploit time. Because exploitation was reported in the wild in October 2024 by PSAUX and this issue is ransomware-associated, expand the lookback to at least October 2024 for long-lived exposed systems, or to the full retention window if logs are shorter. Investigate any threat-intelligence, IDS, AV, or EDR alert referencing PSAUX, CyberPanel getresetstatus exploitation, command injection, or ransomware staging on CyberPanel hosts.

• /dns/getresetstatus
• /ftp/getresetstatus
• GET /dns/getresetstatus
• GET /ftp/getresetstatus
• POST /dns/getresetstatus
• POST /ftp/getresetstatus
• statusfile=
• statusfile=%3B
• statusfile=%7C
• statusfile=%26
• statusfile=%60
• statusfile=$(
• statusfile=;
• statusfile=|
• statusfile=&
• dns/views.py
• ftp/views.py
• getresetstatus
• secMiddleware
• /bin/sh -c
• bash -c
• curl http
• wget http
• /tmp/
• /var/tmp/
• /dev/shm/
• authorized_keys
• /etc/cron.d/
• /var/spool/cron/
• PSAUX

What your security team should do

• Immediately inventory all CyberPanel instances, prioritizing internet-facing systems.
• Patch or upgrade CyberPanel to a release containing commit 1c0c6cb or later; treat versions through 2.3.6 and unpatched 2.3.7 as vulnerable.
• Because the issue is in CISA KEV, ransomware-associated, and past the 2024-12-25 remediation deadline, handle exposed unpatched systems as urgent incident-response cases.
• Restrict CyberPanel administrative access to trusted networks, VPN, or bastion hosts; do not expose the panel broadly to the internet.
• Search web, reverse proxy, WAF, EDR, shell history, process, and authentication logs for access to /dns/getresetstatus and /ftp/getresetstatus, especially requests containing statusfile and shell metacharacters.
• If suspicious activity is found, isolate the host, preserve forensic evidence, terminate malicious processes, remove persistence, rotate credentials, and assess hosted sites and databases for tampering.
• Hunt for common post-exploitation artifacts such as unexpected cron jobs, new SSH authorized_keys entries, unknown web shells, recently modified web content, and outbound downloads from curl or wget.
• Add SIEM/WAF detections for unauthenticated requests to the affected endpoints and for statusfile values containing command separators or shell expansion characters.
• Review backups and recovery plans for hosted services because this vulnerability has been used in ransomware-related activity.
• Apply relevant operating system package updates, including the listed MariaDB/MySQL fixed versions where applicable, while separately ensuring CyberPanel itself is fixed.