Control Web Panel (CWP) < 1.30 OS Command Injection via valid_token

Summary

Control Web Panel (CWP) before webpanel_version 1.30 contains an OS command injection vulnerability in the loopback API /valid_token/ route that allows unauthenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the unvalidated 'user' parameter. Attackers can send a crafted request to the /valid_token/ route, which passes the parameter unescaped into a shell_exec() call.

Remediation

1. Inventory every Control Web Panel Control Web Panel deployment, including staging.
2. Upgrade Control Web Panel Control Web Panel to 1.30.
3. Confirm the running version after the upgrade.

References

• Patchhttps://control-webpanel.com/changelog
• Advisoryhttps://www.vulncheck.com/advisories/control-web-panel-cwp-os-command-injection-via-valid-token
• Referencehttps://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rce