Path Traversal in CyberPanel via cloudAPI ReadReport

Executive Summary

CyberPanel before version 3.0.0 has a path traversal vulnerability in the cloudAPI ReadReport endpoint. Authenticated administrators can read arbitrary files from the server filesystem by manipulating the reportFile parameter in JSON requests. The parameter is passed directly to open() in cloudManager.py without validation, allowing access to sensitive files like credentials, SSL/SSH keys, and JWT secrets.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for requests to the cloudAPI ReadReport endpoint with unsanitized file paths in the reportFile parameter. Check server logs for suspicious file access attempts by the CyberPanel process. Use commands like 'grep -r "ReadReport" /var/log/' to search for relevant logs. Ensure CyberPanel is updated to version 3.0.0 or later.

Useful 0 Not Useful 0

Impact Analysis

An attacker with admin access could exploit this to read sensitive files on the server, including configuration files, private keys, and credentials. This could lead to further attacks like privilege escalation, data theft, or server compromise if combined with other vulnerabilities.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR (data protection) and HIPAA (health information privacy) requirements. Organizations may face compliance penalties, legal consequences, and reputational damage if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update CyberPanel to version 3.0.0 or later to patch the vulnerability. If updating is not possible, restrict access to the cloudAPI ReadReport endpoint and implement strict input validation for the reportFile parameter. Review file permissions to ensure the CyberPanel process cannot access sensitive files.

Useful 0 Not Useful 0