Critical Bugs in Control Web Panel Expose Linux Servers to RCE Attacks
Jan 22, 2022
Researchers have disclosed details of two critical security vulnerabilities in Control Web Panel that could be abused as part of an exploit chain to achieve pre-authenticated remote code execution on affected servers. Tracked as CVE-2021-45467 , the issue concerns a case of a file inclusion vulnerability , which occurs when a web application is tricked into exposing or running arbitrary files on the web server. Control Web Panel, previously CentOS Web Panel, is an open-source Linux control panel software used for deploying web hosting environments. Specifically, the issue arises when two of the unauthenticated PHP pages used in the application — "/user/login.php" and "/user/index.php" — fail to adequately validate a path to a script file, according to Octagon Networks' Paulos Yibelo , who discovered and reported the flaws. This means that in order to exploit the vulnerability, all an attacker has to do is to alter the include statement , which is used...
