English
Magyar
Malicious hackers have begun exploiting the critical CVE-2022-44877 vulnerability in unpatched versions of CentOS Web Panel (CWP), a popular free, closed-source web hosting interface.
The vulnerability allows remote code execution without authentication and was patched in October after Numan Turle, a researcher at Gais Cyber Security, discovered and reported it, and published the proof-of-concept exploit on 3 January. GreyNoise and The Shadowserver Foundation subsequently recorded active exploitation, with the latter noting the initial exploitation on 6 January.
Although the critical vulnerability affecting the Control Web Panel was officially patched on 25 October 2022, evidence of active exploitation is beginning to mount.
CVE-2022-44877 is a remote code execution vulnerability caused by a single line of code in the /login/index.php file, which allows unauthenticated attackers to execute code on a server running the Control Web Panel.
To log errors, the problematic line uses the following structure: echo: “incorrect entry, IP address, HTTP REQUEST URI” is returned. According to the researchers, as the request URI originates from the user and is enclosed in quotation marks, it is possible to execute commands such as $(blabla), which is a bash function.
As the logging functions are based on bash (via the echo command) and the HTTP REQUEST URI parameter is user-controlled, an attacker could use the built-in bash feature known as ‘Command Substitution’ to construct an HTTP request containing ‘malicious’ system commands.
In some attacks, the exploit is used to launch a reverse shell. Using Python’s pty module, the encoded payloads are converted into Python commands that call the attacker’s machine and launch a terminal on the vulnerable host.
According to GreyNoise, at least four different IP addresses are currently actively exploiting the vulnerability. System administrators are therefore urged to act quickly and update CWP to the latest available version, which is currently version 0.9.8.1148, released on 1 December 2022.