> ## Content Index
> Fetch the complete content index at: https://darkwebinformer.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# CVE-2024-53376: CyberPanel Authenticated RCE < 2.3.8
- URL: https://darkwebinformer.com/cve-2024-53376-cyberpanel-authenticated-rce-2-3-8/
- Published: 2024-12-16T19:16:00.000Z
- Updated: 2025-09-04T22:24:57.000Z
- Author: Dark Web Informer
- Tags: Vulnerabilities, Tools

---

GitHub: <https://github.com/ThottySploity/CVE-2024-53376>

---

CyberPanel Authenticated OS Command Injection

### Affected Devices

[](https://github.com/ThottySploity/CVE-2024-53376#affected-devices)

CyberPanel versions < 2.3.8 are vulnerable to an OS command injection. To exploit the vulnerability the attacker is required to firstly login to the webpanel.

### Tested With

[](https://github.com/ThottySploity/CVE-2024-53376#tested-with)

CyberPanel 2.3.7

### Technical details

[](https://github.com/ThottySploity/CVE-2024-53376#technical-details)

An attacker can use a HTTP OPTIONS request to instruct the webserver running the CyberPanel application to execute arbitrary commands. This vulnerability lies in the /websites/submitWebsiteCreation endpoint.

This endpoint calls the submitWebsiteCreation function in the /websiteFunctions/views.py file location.

![](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2024/12/895978251.png)

This function further calls the `wm.submitWebsiteCreation` function found in the /websiteFunctions/website.py file. This function extracts five parameters which are used within the function: - domain; - adminEmail; - phpSelection; - packageName; - websiteOwner;

![](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2024/12/895978252.png)

These parameters are later parsed directly to a function that executes these:

![](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2024/12/895978253.png)

The Proof-of-Concept (PoC) code can be found in the cyberpanel.py file that is linked in this repo.

### PoC

[](https://github.com/ThottySploity/CVE-2024-53376#poc)

This Proof-of-Concept can be used to write files with root level permissions, anywhere on the system:

![](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2024/12/895978254.png)

This could result in a complete device compromise. If the device's CyberPanel installation folder is accessible, data can be more easily extracted through the web panel.

### Writeup

[](https://github.com/ThottySploity/CVE-2024-53376#writeup)

The writeup which outlines the discovery process of the exploit will become available at: <https://thottysploity.github.io/posts/cve-2024-53376>

### Timeline

[](https://github.com/ThottySploity/CVE-2024-53376#timeline)

30.10.2024 - Identified vulnerability  
31.10.2024 - Contacted Usman Nasir, owner of CyberPanel  
02.11.2024 - Usman fixed the issue and published a fix  
03.11.2024 - Requested CVE-ID from MITRE  
23.11.2024 - MITRE reserved CVE-ID 2024-53376