Control Web Panel (CWP) < 1.16 OS Command Injection via /newpass/

Summary

Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the loopback API password change route /newpass/, which runs as root. An attacker can inject arbitrary OS commands by manipulating the POST 'user' parameter that is passed unescaped into a shell command, achieving remote code execution with root privileges.

Remediation

1. Inventory every Control Web Panel Control Web Panel deployment, including staging.
2. Upgrade Control Web Panel Control Web Panel to 1.16.
3. Confirm the running version after the upgrade.

References

• Patchhttps://control-webpanel.com/changelog
• Advisoryhttps://www.vulncheck.com/advisories/control-web-panel-cwp-os-command-injection-via-newpass
• Referencehttps://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rce