Executive Summary

The vulnerability exists in CtrlPanel, an open-source billing software for hosting providers, specifically in versions 1.1.1 and earlier. The web-based installer is vulnerable to unauthenticated Remote Code Execution (RCE) because it executes form handler files before checking if the software is already installed (via the install.lock file). This means that installer endpoints remain accessible even after installation.

The form handlers take user input and directly insert it into shell commands without sanitization, allowing an attacker to craft requests that execute arbitrary commands on the server. The root causes are the premature execution of form handlers before the lock file check and unsafe handling of user input in shell commands.

This vulnerability has been actively exploited in the wild and was fixed in version 1.2.0.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an unauthenticated attacker to execute arbitrary commands on the server running CtrlPanel. This can lead to full system compromise, including unauthorized access to sensitive data, modification or deletion of files, disruption of services, and potentially using the server as a foothold to attack other systems.

Because the vulnerability has a CVSS base score of 10.0, it represents a critical risk with high impact on confidentiality, integrity, and availability.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability has been fixed in CtrlPanel version 1.2.0. The immediate step to mitigate this vulnerability is to upgrade your CtrlPanel installation to version 1.2.0 or later.

Since the issue involves the installer endpoints being reachable on already-installed instances, as a temporary mitigation, you should ensure that the installer directory (public/installer/) is not accessible on production systems, for example by removing or restricting access to it.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated remote code execution on the affected CtrlPanel software, potentially leading to unauthorized access and control over the server.

Such unauthorized access and potential data breaches could impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive data against unauthorized access and ensure system integrity.

Because the vulnerability allows attackers to execute arbitrary commands, it could lead to exposure or manipulation of protected data, thereby violating confidentiality, integrity, and availability requirements mandated by these regulations.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves checking if the vulnerable installer endpoint is accessible on an already-installed instance and if it allows execution of arbitrary commands via crafted requests.

One approach is to attempt accessing the installer URL path /public/installer/index.php on the target system to see if it is reachable.

You can use curl or wget commands to test the accessibility of the installer endpoint, for example:

• curl -i http://target-server/public/installer/index.php
• wget --spider http://target-server/public/installer/index.php

If the installer page is accessible despite the application being installed, it indicates the presence of the vulnerability.

Further, crafted requests that include shell commands in parameters sent to the installer form handlers could be tested in a controlled environment to confirm RCE vulnerability.

Monitoring network traffic for unusual requests targeting /public/installer/index.php or suspicious shell command patterns may also help detect exploitation attempts.

Useful 0 Not Useful 0