Control Web Panel (CWP) < 1.12 Authentication Bypass via Execution After Redirect

Summary

Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flow, where CWPUserIndex's unauthenticatedFlow() calls toLoginWithIntendedUri() which emits a redirect header without exit(), allowing PHP execution to continue and the module dispatcher include to run without authentication. Attackers with nothing more than a valid hosting username can bypass authentication to reach user-panel module code paths, enabling a pre-authentication chain to root access.

Remediation

1. Inventory every Control Web Panel Control Web Panel deployment, including staging.
2. Upgrade Control Web Panel Control Web Panel to 1.12.
3. Confirm the running version after the upgrade.

References

• Patchhttps://control-webpanel.com/changelog
• Advisoryhttps://www.vulncheck.com/advisories/control-web-panel-cwp-authentication-bypass-via-execution-after-redirect
• Advisoryhttps://www.vulncheck.com/advisories/control-web-panel-cwp-execution-after-redirect-in-cwpuserindex
• Referencehttps://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rce