CVE-2024-51378

The vulnerability in CyberPanel arises from improper authentication mechanisms in the handling of requests within the getresetstatus function located in the dns/views.py and ftp/views.py files. This flaw allows remote attackers to bypass authentication controls and execute arbitrary commands by manipulating the statusfile property with shell metacharacters. The vulnerability specifically exploits a weakness in the secMiddleware, which is designed to enforce security checks but is only applied to POST requests. As a result, attackers can leverage GET requests to gain unauthorized access to sensitive functionalities, leading to potential command execution on the server.

Attack vectors for this vulnerability are particularly concerning due to their simplicity and effectiveness. An attacker can craft a GET request to either /dns/getresetstatus or /ftp/getresetstatus, embedding malicious input that takes advantage of the lack of proper input validation and authentication checks. By including shell metacharacters in the request, the attacker can manipulate the server's command execution context, allowing them to run arbitrary commands with the privileges of the web server process. This exploitation can lead to a range of malicious activities, including data exfiltration, system compromise, and further lateral movement within the network.

The real-world impact of this vulnerability is significant, particularly for organizations that rely on CyberPanel for managing their web hosting environments. Given the high CVSS score of 9.8, the potential for exploitation is severe, with attackers able to gain control over critical systems. The consequences of such an attack can include unauthorized access to sensitive data, disruption of services, and significant financial losses due to remediation efforts and reputational damage. Furthermore, the fact that this vulnerability has been actively exploited in the wild underscores the urgency for organizations to address it promptly to mitigate risks.

To detect and mitigate this vulnerability, organizations should implement a multi-layered security approach. Regularly updating CyberPanel to the latest patched version is essential, as this will address the vulnerability and close the attack vector. Additionally, employing web application firewalls (WAFs) can help filter out malicious requests before they reach the application layer. Monitoring logs for unusual access patterns, especially around the affected endpoints, can also aid in early detection of potential exploitation attempts. Furthermore, organizations should conduct regular security assessments and penetration testing to identify and remediate vulnerabilities proactively.

In conclusion, the vulnerability within CyberPanel presents a critical threat to organizations utilizing this platform for web hosting. The ease of exploitation, coupled with the potential for severe consequences, necessitates immediate attention and action. By understanding the technical details, attack vectors, and real-world implications, organizations can better prepare themselves to defend against such threats. Implementing robust detection and mitigation strategies will not only protect against this specific vulnerability but also enhance the overall security posture of the organization.

CSURFACE threat intelligence has noted a critical update to CVE-2024-51378, with the CVSS score elevated from 9.8 to a perfect 10.0, reflecting the vulnerability’s absolute exploitability and impact. This change coincides with its formal inclusion in the Known Exploited Vulnerabilities (KEV) catalog, underscoring its recognition as a high-priority threat. Our telemetry confirms that exploitation remains stable but persistent, particularly leveraged by the PSAUX ransomware group, which continues to target CyberPanel instances extensively. The availability of multiple publicly accessible proof-of-concept exploits and integration into Metasploit modules has lowered the barrier for adversaries, increasing the likelihood of widespread compromise. For defenders, this escalation signals an urgent need to reassess risk exposure, as the vulnerability’s criticality is now unequivocally affirmed by authoritative scoring and threat intelligence frameworks. The threat landscape remains highly active, with ransomware campaigns exploiting this flaw to achieve remote code execution without authentication, thereby amplifying potential operational and data security impacts.

Update 2 — June 09, 2026

Recent updates to CVE-2024-51378 include a refinement of its CVSS score from a perfect 10.0 to 9.8, reflecting a more precise assessment of its impact and exploitability. This adjustment aligns with the vulnerability’s confirmed criticality while incorporating nuanced factors such as the specific attack vector and conditions required for exploitation. CSURFACE threat intelligence confirms that the exploitability remains exceptionally high, supported by stable EPSS scoring near the maximum percentile and continued availability of multiple proof-of-concept exploits on public repositories. Our telemetry indicates persistent use of this vulnerability in ransomware campaigns, notably by the PSAUX group, underscoring its ongoing operational relevance. The inclusion of this CVE in the KEV catalog with a defined due date for remediation further elevates its priority within vulnerability management frameworks. For defenders, this recalibration of severity does not diminish urgency but rather contextualizes the risk with greater precision, emphasizing the critical need for timely patching and monitoring. The threat level remains at a critical threshold, with active exploitation and integration into widely used offensive toolkits sustaining a high likelihood of compromise in unpatched environments.