Control Web Panel (CWP) < 1.30 Unauthenticated Loopback API Root Access

Summary

Control Web Panel (CWP) before webpanel_version 1.30 contains a missing authentication vulnerability that allows attackers able to reach the loopback API service to invoke root-privileged API routes without presenting an access token. Attackers can access endpoints such as /v1/restoredatabase/, /generaluser/, /last_access/, /valid_user/, /valid_token/, and /user_panel_dashboard/ to perform unauthorized actions with root privileges.

Remediation

1. Inventory every Control Web Panel Control Web Panel deployment, including staging.
2. Upgrade Control Web Panel Control Web Panel to the fixed version for your release line, listed under Affected versions.
3. Confirm the running version after the upgrade.

References

• Patchhttps://control-webpanel.com/changelog
• Advisoryhttps://www.vulncheck.com/advisories/control-web-panel-cwp-unauthenticated-loopback-api-root-access
• Referencehttps://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rce