Horizon Alert
Summary of the vulnerability and why it matters
A vulnerability in Control Web Panel allows unauthenticated attackers to manipulate password reset links, potentially leading to account takeover and command execution. This issue arises from the way the system handles host headers during the password recovery process, enabling attackers to exfiltrate recovery tokens and gain unauthorized access.
- Control Panel can be tricked into password resets.
- Account takeover and command execution are possible.
- Verify if this specific web panel is in use.
Attack Path
How an attacker could exploit the issue
An attacker can manipulate the password reset process by injecting a malicious Host header, tricking automated email scanners into visiting a crafted link. This allows the attacker to intercept a password recovery token, reset the target account's password, and then gain command execution through the File Manager and Crontab modules.
- No authentication needed.
- Automated scanner visits poisoned link.
- Command execution as hosting account.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could allow an unauthenticated attacker to reset the password for any user account on a Control Web Panel instance. By manipulating the Host header during a password reset request, an attacker can craft a malicious link. When an automated security scanner accesses this link, it inadvertently exfiltrates a valid password reset token, which the attacker can then use to take control of the targeted hosting account.
- Hosting account credentials and associated data.
- Via manipulated password reset link and scanner interaction.
- Command execution on the hosting account.
Operational Fix
Recommended remediation, mitigation, and detection steps
Systems running Control Web Panel (CWP) require immediate attention from platform and infrastructure teams. The first practical step is to locate all CWP instances, confirm their internet reachability and business criticality, and then identify the specific asset owners responsible for each instance to prioritize remediation efforts.
- Platform and infrastructure teams own remediation.
- Verify CWP instance reachability and criticality.
- Plan maintenance for timely patching.
