CVE-2024-51567

What it actually does

CVE-2024-51567 is an unauthenticated command injection flaw in CyberPanel’s `upgrademysqlstatus` handler in `databases/views.py`. The vulnerable `/dataBases/upgrademysqlstatus` route can be reached in a way that bypasses the intended `secMiddleware` authentication protection, and attacker-controlled input in the `statusfile` property is passed to shell execution without safe validation or escaping. As a result, a remote attacker can execute arbitrary operating-system commands with the privileges of the CyberPanel application process. This can lead to web shell deployment, malware installation, credential theft, lateral movement, data destruction, or full server compromise.

Why it matters to the business

A vulnerable Internet-facing CyberPanel server can be taken over remotely without valid credentials. Because this vulnerability is known to be exploited in the wild, is listed in CISA KEV, has a high EPSS score, and has been associated with ransomware activity, exposed systems should be treated as high-priority incident-response candidates, not routine patching items. Successful exploitation can disrupt hosted websites, mail, databases, and control-panel operations; expose customer or administrative data; and allow attackers to use the server for ransomware, botnet activity, phishing, or further attacks. CISA’s KEV remediation deadline was 2024-11-28, so any remaining exposure is significantly overdue.

How an attack unfolds

An attacker first identifies an Internet-accessible CyberPanel instance. They send a crafted request to `/dataBases/upgrademysqlstatus` that avoids the middleware path intended to enforce authentication. The request includes a malicious `statusfile` value containing shell metacharacters or command separators. CyberPanel processes the value in the vulnerable `upgrademysqlstatus` function and passes it into a shell context, causing the attacker’s command to run on the server. In real-world exploitation, attackers can use this primitive to download and execute payloads, create persistence, add users or SSH keys, deploy web shells, disable services, enumerate credentials and hosted sites, or launch ransomware. Because exploitation has occurred in the wild since at least October 2024 and the issue is in KEV with ransomware association, any matching exposure should be investigated for compromise as well as patched.

How to fix it

Upgrade CyberPanel to a version that includes commit `5b08cd6d53f4dbc2107ad9f555122ce8b0996515` or later. CyberPanel versions through 2.3.6 and unpatched 2.3.7 should be considered vulnerable. If CyberPanel was installed from source, verify that the deployed code contains the fixed `databases/views.py` logic and not only a package version label. If immediate upgrade is not possible, remove direct Internet access to CyberPanel, restrict access to trusted administrative VPN or management networks, block requests to `/dataBases/upgrademysqlstatus` at a reverse proxy or WAF, and stop the CyberPanel service until patched if exposure cannot be controlled. Rotate CyberPanel administrator credentials, database credentials, hosting account credentials, and any secrets stored on the server after patching if exploitation cannot be confidently ruled out. The provided fixed-version list also mentions Ubuntu MySQL 5.7 package `5.7.15-0ubuntu0.16.04.1`, but the command injection described here is in CyberPanel; do not treat a MySQL package update alone as remediation for the CyberPanel RCE.

How to confirm the fix worked

Confirm the installed CyberPanel codebase includes commit `5b08cd6d53f4dbc2107ad9f555122ce8b0996515` or a vendor release containing that fix. Review the deployed `databases/views.py` implementation and verify that `upgrademysqlstatus` no longer permits unauthenticated access and no longer passes attacker-controlled `statusfile` data to shell execution unsafely. From an unauthenticated test client, verify that `/dataBases/upgrademysqlstatus` cannot be reached successfully and returns an authentication failure, authorization failure, or safe error for all HTTP methods. Check reverse proxy, firewall, and WAF rules to ensure CyberPanel administrative routes are not publicly reachable unless explicitly required. Run authenticated vulnerability scanning or configuration assessment after the upgrade, and separately perform compromise assessment because patching does not remove payloads or persistence left by prior exploitation.

Typical attack path

1. Scan the Internet for exposed CyberPanel services or known CyberPanel web routes.
2. Send a request to `/dataBases/upgrademysqlstatus` using a method or request pattern that bypasses the intended authentication middleware.
3. Place shell metacharacters or command separators in the `statusfile` parameter.
4. Trigger CyberPanel to execute the injected operating-system command.
5. Run reconnaissance commands such as user, process, network, and filesystem enumeration.
6. Download a second-stage payload using tools such as curl, wget, Python, or shell redirection.
7. Establish persistence through cron jobs, SSH keys, additional users, web shells, or service modifications.
8. Access hosted site data, databases, credentials, or configuration files.
9. Use the server for ransomware deployment, further lateral movement, botnet activity, or destructive actions.

How to detect it

Review HTTP access logs from CyberPanel, reverse proxies, load balancers, and WAFs for requests to `/dataBases/upgrademysqlstatus`, especially requests from unknown sources, unauthenticated clients, unusual HTTP methods, non-browser user agents, or requests containing a `statusfile` parameter. Look for raw or URL-encoded shell metacharacters in `statusfile`, including semicolons, pipes, ampersands, backticks, `$()`, redirection operators, newline encodings, and command names such as `curl`, `wget`, `bash`, `sh`, `python`, `perl`, `chmod`, `chattr`, `crontab`, or `nc`. Correlate suspicious web requests with process creation telemetry showing the CyberPanel process or web service spawning shell interpreters, download utilities, scripting runtimes, or archive tools. Review CyberPanel logs, system authentication logs, shell histories, cron directories, systemd unit directories, temporary directories, hosted web roots, and SSH authorized keys for changes shortly after suspicious requests. Investigate unexpected outbound connections from CyberPanel servers after access to the vulnerable endpoint, especially downloads from unknown IPs or domains. Because this vulnerability has been exploited in the wild and is associated with ransomware, also hunt for mass file modifications, ransom notes, disabled services, suspicious encryption processes, and attempts to stop backup or security tools.

• /dataBases/upgrademysqlstatus
• upgrademysqlstatus
• statusfile=
• statusfile=%3B
• statusfile=;
• statusfile=%7C
• statusfile=|
• statusfile=%26
• statusfile=&
• statusfile=%60
• statusfile=`
• statusfile=$(
• statusfile=%24%28
• statusfile=%0A
• statusfile=%0D
• /usr/local/CyberCP/databases/views.py
• databases/views.py
• curl%20
• wget%20
• bash%20-c
• sh%20-c
• python%20-c
• perl%20-e
• chmod%20%2Bx
• crontab%20
• /etc/cron.d/
• /etc/crontab
• /root/.ssh/authorized_keys
• /tmp/
• /var/tmp/

What your security team should do

• Immediately inventory all CyberPanel instances, especially Internet-facing administrative panels, and identify versions through 2.3.6 or unpatched 2.3.7.
• Patch or upgrade CyberPanel to a build containing commit `5b08cd6d53f4dbc2107ad9f555122ce8b0996515` or later; prioritize exposed systems first.
• Treat exposed vulnerable systems as potentially compromised due to active in-the-wild exploitation, KEV listing, high EPSS probability, and ransomware association.
• Restrict CyberPanel access to a VPN, bastion, or trusted administrative IP ranges; do not expose the control panel broadly to the Internet.
• Search historical web, application, process, EDR, and shell logs for access to `/dataBases/upgrademysqlstatus` and suspicious `statusfile` command-injection patterns.
• Hunt for post-exploitation artifacts such as unexpected web files, cron jobs, SSH keys, new users, downloader commands, suspicious child processes, and recently modified files under CyberPanel and hosted web roots.
• Rotate administrative, hosting, SSH, database, and API credentials on systems where exploitation is suspected or cannot be ruled out.
• If malicious execution is confirmed, isolate the host, preserve forensic evidence, rebuild from trusted media where practical, and restore hosted content from known-good backups.
• Add SIEM and WAF detections for requests to `/dataBases/upgrademysqlstatus`, especially unauthenticated requests and requests containing encoded or raw shell metacharacters.
• Review ransomware readiness for affected hosting environments, including offline backups, restore testing, and separation of management credentials.