CVE-2024-51567: CyberPanel: pre-auth RCE via secMiddleware bypass

CyberPanel, a widely deployed web hosting control panel, has a pre-authentication remote code execution flaw where the /dataBases/upgrademysqlstatus endpoint bypasses its security middleware — which only validates POST requests — and passes the statusfile parameter unsanitized into a shell command. This is a maximum-severity issue (CVSS 10) sitting in CISA's KEV catalog with an ACT SSVC decision and an EPSS score in the top 0.03% percentile for exploitation likelihood, and it has already been mass-exploited: the PSAUX ransomware campaign hit an estimated 22,000 CyberPanel instances in October 2024. A public PoC and a Nuclei scanning template exist, so unpatched internet-facing instances get found and compromised automatically, not by targeted actors. CyberPanel itself is general server-management software rather than an AI framework, but it is commonly used to host self-managed application stacks — including self-hosted AI/ML workloads such as inference servers, model dashboards, or RAG backends — so a compromised panel hands an attacker root-level control over anything colocated on that box, including model weights, API keys, and database credentials. Patch immediately to the fixed commit (5b08cd6 or later — verify your CyberPanel release actually ships the fix, since 2.3.7 was still unpatched at disclosure), and until patched, block or restrict access to /dataBases/upgrademysqlstatus and watch for anomalous outbound traffic or mass file encryption consistent with PSAUX IOCs.

Yes, CVE-2024-51567 is confirmed actively exploited and listed in CISA Known Exploited Vulnerabilities catalog since Thu Nov 07 2024 00:00:00 GMT+0000 (Coordinated Universal Time).

1) Patch to the fixed commit 5b08cd6 or later immediately; confirm your installed version actually includes the fix (2.3.7 was still unpatched at time of disclosure per the advisory). 2) If immediate patching isn't possible, block or firewall access to /dataBases/upgrademysqlstatus and any non-POST access to secMiddleware-protected routes. 3) Deploy a WAF/reverse-proxy rule to strip or reject shell metacharacters in the statusfile parameter. 4) Scan your own perimeter with the public Nuclei template to confirm exposure before an attacker does. 5) Hunt for PSAUX ransomware IOCs (unexpected encrypted files, ransom notes, unusual cron/systemd persistence) on any CyberPanel host. 6) Network-segment CyberPanel-managed hosts away from AI/ML secrets stores (model registries, vector DBs, inference API keys) so a panel compromise doesn't cascade. 7) Since CISA KEV due date (2024-11-28) has passed, treat any still-unpatched instance as a compliance gap for federal/regulated environments.

This vulnerability affects the following AI/ML architecture patterns: Self-hosted AI/ML hosting infrastructure, Model serving endpoints, Web-based admin/management UIs for AI workloads.

CVE-2024-51567 has a CVSS v3.1 base score of 10.0 (CRITICAL). The EPSS exploitation probability is 86.63%.