See runZero in action

Contact us to book a demo with our team.

Finding Control Web Panel (CWP) instances

(updated ), by Pearce Barry
icon

Security researcher Paulos Yibelo shared findings this week on two new vulnerabilities within the popular Control Web Panel (formerly CentOS Web Panel) web hosting management software. Both CVE-2021-45466 (a file write vulnerability) and CVE-2021-45467 (a file inclusion vulnerability) are interesting individually, but they provide a powerful attack vector when chained together to achieve pre-authentication remote code execution (RCE) on a vulnerable target. Taking into account the 200k+ unique, public-facing servers currently running CWP, there could be many systems at risk of exploitation.

The maintainers of CWP have patched CVE-2021-45467 in the most recent release (v0.9.8.1122), with the guidance for administrators of CWP installations to upgrade to this version as soon as possible. No interim mitigation strategies have been shared.

How to find Control Web Panel (CWP) instances with runZero #

From the Asset Inventory, use the following pre-built query to locate potentially vulnerable Control Web Panel instances within your network:

service.product:"CentOS Web Panel"
Find CWP instances

Please note that though the older product name is used in the query, the underlying match logic is using the web server value found in HTTP header responses from the CWP server, which has remained the same across the product name change.

As always, any prebuilt queries we create are available from our Queries Library. Check out the library for other useful inventory [queries]/docs/search-query-list/).

Get runZero for free

Find Control Web Panel instances on your network in minutes with runZero.

Get started
runZero on laptop
Pearce Barry
Written by Pearce Barry

Pearce Barry is a Director of Security Research at runZero. Barry joined runZero in June 2021, working on the Metasploit Project the four years prior. Now, Pearce leads research efforts at runZero, which includes creating and improving fingerprints, adding to protocols, enhancing scanning logic, and writing queries.

Similar Content

November 9, 2023

How to find SysAid Help Desk instances

How to find SysAid Help Desk instances # On the evening of November 8th Microsoft Threat Intelligence announced that they had discovered attacks by a ransomware gang against the SysAid Help Desk software using a zero-day exploit (CVE-2023-47246). These attacks leveraged a …

Read More

November 1, 2023

How to find Apache ActiveMQ instances

How to find Apache ActiveMQ® instances # On October 25th the Apache team announced a vulnerability (CVE-2023-46604) in ActiveMQ that could lead to unauthenticated remote code execution. Shortly after the issue was disclosed exploits started to appear and the Rapid7 MDR team …

Read More

October 30, 2023

Finding NGINX Ingress Controllers with runZero

Today, three vulnerabilities in the NGINX Ingress Controller for Kubernetes were disclosed, as described in this article from The Hacker News. These vulnerabilities have CVSS scores ranging from 7.6 to 8.8; all of these scores are considered high. These vulnerabilities have …

Read More