CentOS Web Panel - Remote Code Execution (CVE-2022-44877)
- Severity
- CVSSv3 Score
- 9.8
- Exploitable with Sniper
- Yes
- Vulnerability description
CentOS Web Panel is vulnerable to CVE-2022-44877, an OS Command Injection vulnerability that allows remote attackers to execute commands via shell metacharacters in the login parameter. The root cause of this vulnerability is inside the logging functionality that relies on bash (via the echo command) allowning an attacker to take advantage of a built in bash feature called Command Substitution by crafting a malicous HTTP request containing system commands.
- Exploit capabilities
Sniper can gain unauthenticated Remote Code Execution on the target system and extract multiple artefacts as evidence.
- Risk description
The risk exists that a remote unauthenticated attacker can fully compromise the CentOS Web Panel Server to steal confidential information, install ransomware, or pivot to the internal network.
- Recommendation
Upgrade the CentOS Web Panel to the latest version.
- References
https://nvd.nist.gov/vuln/detail/CVE-2022-44877
https://control-webpanel.com/changelog#1674073133745-84af1b53-c121
- Detectable with
- Network Scanner
- Vuln date
- Jan 2023
- Published at
- Updated at
- Software Type
- Server administration software
- Vendor
- CentOS Project
- Product
- CWP
- Codename
- Not available