REMOTE CODE EXECUTION — Vulnerability with 9.8 severity in Control Web Panel is under active exploit A patch was released in October, but not all servers have installed it.
Dan Goodin – Jan 13, 2023 12:56 am UTC EnlargeGetty Images reader comments 19 with 0 posters participating Share this story Share on Facebook Share on Twitter Share on Reddit
Malicious hackers have begun exploiting a critical vulnerability in unpatched versions of the Control Web Panel, a widely used interface for web hosting.
This is an unauthenticated RCE, members of the Shadowserver group wrote on Twitter, using the abbreviation for remote code exploit. Exploitation is trivial and a PoC published. PoC refers to a proof-of-concept code that exploits the vulnerability.
The vulnerability is tracked as CVE-2022-44877. It was discovered by Numan Trle of Gais Cyber Security and patched in October in version 0.9.8.1147. Advisories didnt go public until earlier this month, however, making it likely some users still arent aware of the threat.
Figures provided by Security firm GreyNoise show that attacks began on January 7 and have slowly ticked up since then, with the most recent round continuing through Wednesday. The company said the exploits are coming from four separate IP addresses located in the US, Netherlands, and Thailand. Advertisement
Shadowserver shows that there are roughly 38,000 IP addresses running Control Web Panel, with the highest concentration in Europe, followed by North America, and Asia.
The severity rating for CVE-2022-44877 is 9.8 out of a possible 10. Bash commands can be run because double quotes are used to log incorrect entries to the system, the advisory for the vulnerability stated. As a result, unauthenticated hackers can execute malicious commands during the login process. The following video demonstrates the flow of the exploit. Centos Web Panel 7 Unauthenticated Remote Code Execution – CVE-2022-44877
The vulnerability resides in the /login/index.php component and resulted from CWP using a faulty structure when logging incorrect entries, according to the Daily Swig. The structure is: echo “incorrect entry, IP address, HTTP_REQUEST_URI” >> /blabla/wrong.log. Since the request URI comes from the user, and as you can see it is within double quotes, it is possible to run commands such as $(blabla), which is a bash feature, Trle told the publication.
Given the ease and severity of exploitation and the availability of working exploit code, organizations using Control Web Panel should ensure theyre running version 0.9.8.1147 or higher. reader comments 19 with 0 posters participating Share this story Share on Facebook Share on Twitter Share on Reddit Dan Goodin Dan is the Security Editor at Ars Technica, which he joined in 2012 after working for The Register, the Associated Press, Bloomberg News, and other publications. Find him on Mastodon at: https://infosec.exchange/@dangoodin Email dan.goodin@arstechnica.com Advertisement Channel Ars Technica ← Previous story Next story → Related Stories Today on Ars
