CVE-2024-53376 — AI Deep Analysis Summary

🚨 **Essence**: CyberPanel < 2.3.8 suffers from **OS Command Injection** via the `phpSelection` field in `/websites/submitWebsiteCreation`.…

🛡️ **Root Cause**: **Shell Metacharacter Injection**. The `phpSelection` input is not sanitized before being passed to the OS command execution function in `websiteFunctions/views.py`.…

📦 **Affected**: **CyberPanel** versions **< 2.3.8**. 🧪 **Tested On**: Version 2.3.7. 🌐 **Component**: The `submitWebsiteCreation` endpoint handling website creation.

💀 **Capabilities**: **Remote Code Execution (RCE)**. 📂 **Impact**: Hackers gain the privileges of the web server process. They can read/modify data, install backdoors, or pivot to other internal systems.…

🔑 **Threshold**: **Medium**. 🚫 **Requirement**: **Authentication Required**. The attacker must **first login** to the CyberPanel web interface.…

🔓 **Public Exploit**: **YES**. 📂 **PoC Available**: GitHub repo by `ThottySploity` provides a Python script (`cyberpanel.py`) for authenticated RCE.…

🔍 **Self-Check**: 1. Check CyberPanel version (must be < 2.3.8). 2. Verify if `/websites/submitWebsiteCreation` is accessible. 3. Use the provided PoC script to test if you have valid credentials.…

🩹 **Fix**: Upgrade to **CyberPanel 2.3.8** or later. 📅 **Published**: Dec 16, 2024. 🛡️ **Mitigation**: If upgrade isn't immediate, restrict access to the panel via IP whitelisting and firewall rules.

🚧 **No Patch Workaround**: 1. **Block External Access**: Restrict panel access to trusted IPs only. 2. **Strong Auth**: Ensure complex, unique passwords for all panel users. 3.…

⚡ **Urgency**: **HIGH**. 📉 **Priority**: Critical for anyone running CyberPanel < 2.3.8. Even though auth is needed, leaked credentials are common. RCE risk is severe.…