CyberPanel - Authentication Bypass (CVE-2024-51567)

CVE-2024-51567 is a critical vulnerability in CyberPanel that enables remote attackers to bypass authentication and execute arbitrary commands via crafted requests, abusing inadequate request filtering on a specific endpoint.

CrowdSec has been tracking this vulnerability and its exploits since 15th of December 2023.

Data from the CrowdSec community indicates that exploitation of CVE-2024-51567 is highly selective and intelligence-driven. Threat actors use advanced reconnaissance and carefully choose their targets, often as part of sophisticated campaigns or advanced persistent threat operations. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2024-51567 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2024-51567 is currently experiencing high visibility and active exploitation across the internet.

Observed exploitation attempts focus on requests to the /databases/upgrademysqlstatus path.