Hackers exploited an RCE flaw to target over 22,000 CyberPanel servers with PSAUX ransomware. Nearly all CyberPanel instances went offline as a result.

Researchers said that in fact there are three vulnerabilities in CyberPanel versions 2.3.6 and 2.3.7 that allowed hackers to gain unauthorized root access, deploy PSAUX ransomware, and encrypt server files.

CyberPanel released a partial patch on GitHub and users are urged to apply it. A full update will soon follow.

When the experts informed us about the issue, we immediately reviewed their findings and released a security patch within 30 minutes. If the experts are reading this, they know how swiftly we acted. They later advised us to announce this issue publicly, but we requested to hold off to allow users time to update for security reasons.

Source – CyberPanel advisory

How are CyberPanel instances vulnerable?

Bleepingcomputer.com reports that security researcher DreyAnd found three different safety issues in CyberPanel 2.3.6 and 2.3.7. DreyAnd’s proof of concept revealed how the three CyberPanel flaws allow remote command execution with root privileges.

Insecure authentication

CyberPanel doesn’t use a central authentication system. Instead, it checks for user authentication on each page separately. This leaves certain pages or routes vulnerable to unauthorized access. It is the case for ‘upgrademysqlstatus,’

Command injection

The data that users enter on unprotected pages is not properly checked and cleaned for malicious code. Thus, attackers can inject and execute arbitrary system commands.

Security filter bypass

The security middleware only filters POST requests. So, the attackers bypassed it using other HTTP methods, like OPTIONS or PUT.

More about the PSAUX Ransomware Attacks

Hackers used the vulnerability suite to install PSAUX ransomware on CyberPanel instances. The ransomware encrypts server files with unique AES keys. The PSAUX ransomware was first signaled in June 2024 and targets misconfigured, unpatched web servers.

LeakIX threat intelligence platform told Bleepingcomputer that

21,761 vulnerable CyberPanel instances were exposed online, and nearly half (10,170) were in the United States.

Source – Bleepingcomputer.com

After the PSAUX ransomware attacks, only 400 of the servers remained online.

Close vulnerabilities faster than hackers. Heimdal's Patch & Asset Management reduces security risks by up to 70%. Start your patching journey now.

Protection measures against PSAUX ransomware

The first thing that CyberPanel users should do now is update to the latest version on GitHub. CyberPanel will soon release a complete patch.

But there’s more to protecting your web servers against PSAUX ransomware. All software has flaws, that’s why it is critical that SysAdmins constantly check for updates and apply patches. PSAUX ransomware is notoriously targeting poorly patched servers.

[youtube https://www.youtube.com/watch?v=sfbObOjCYNg?si=s87Hs7Vs-hvJ4gnZ]

Using an automated patch management solution to keep all software and all your devices up to date is the best way to stay on top of this task. Automated patch management tools, like Heimdal’s Patch & Asset Management, speed up the patching process and eliminate the risk of human error.

If you liked this article, follow us on LinkedIn, Twitter, Facebook, and Youtube, for more cybersecurity news and topics.

Author Profile

Livia Gyongyoși is a Communications and PR Officer within Heimdal®, passionate about cybersecurity. Always interested in being up to date with the latest news regarding this domain, Livia’s goal is to keep others informed about best practices and solutions that help avoid cyberattacks.

Leave a Reply

Your email address will not be published. Required fields are marked *

Explore More

The Role Regulators Will Play in Guiding AI Adoption to Minimize Security Risks

With Artificial Intelligence (AI) becoming more pervasive within different industries, its transformational power arrives with considerable security threats. AI is moving faster than policy, whereas the lightning-quick deployment of AI

Exploiting Social Media: TikTok Links Used to Hijack Microsoft Accounts

By Brandon Cook and Brooke McLain, Cofense Phishing Defense Center In the fast-paced world of social media, new threats are emerging every day, and not all of them come from

Friday Squid Blogging: Female Gonatus Onyx Squid Carrying Her Eggs

Friday Squid Blogging: Female Gonatus Onyx Squid Carrying Her Eggs Fantastic video of a female Gonatus onyx squid swimming while carrying her egg sack. An earlier related post. Blog moderation