Threat actors are actively mass-exploiting an unauthenticated remote code execution vulnerability, tracked as CVE-2024-51567 (CVSS 10.0), impacting CyberPanel versions 2.3.6 and unpatched 2.3.7. The vulnerability arises from an authentication bypass in CyberPanel’s security middleware, which validated CSRF tokens and access controls solely on HTTP POST requests. By issuing requests with alternate HTTP methods such as PUT or OPTIONS, unauthenticated remote attackers access the /dataBases/upgrademysqlstatus endpoint. The endpoint directly passes the unsanitized statusfile parameter into shell execution routines running with root privileges, granting arbitrary command execution.

Telemetry from LeakIX revealed over 22,000 exposed instances targeted in a mass PSAUX ransomware campaign. Attackers deploy automated Python scripts that kill database services and recursively encrypt web directories using AES-CBC encryption before demanding ransoms. The vulnerability has also been co-opted by cryptominers and botnet operators. CyberPanel issued fixes in version 2.3.8 and GitHub patch commits, while CISA added CVE-2024-51567 to its Known Exploited Vulnerabilities catalog.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: Chaining HTTP verb tampering against naive middleware with shell parameter injection eliminates perimeter boundaries entirely, yielding immediate root-level host compromise without credential prerequisite or user interaction.
• Bullet 2 — Strategic & Defender Imperative: Administrators must update to CyberPanel version 2.3.8 immediately, restrict control panel access (port 8090) to authorized administrative CIDRs, and inspect web server roots for unauthorized .py staging scripts or encrypted files.