Horizon Alert
Summary of the vulnerability and why it matters
A vulnerability exists in CyberPanel's WebTerminal service that allows unauthenticated attackers to gain root access to servers. This issue stems from a hard-coded secret used to sign authentication tokens, enabling attackers to bypass security controls and execute commands as the root user.
- Unauthenticated root access to servers.
- Critical remote code execution vulnerability.
- Confirm relevance and exposure.
Attack Path
How an attacker could exploit the issue
An attacker can reach the vulnerable component by connecting to the WebTerminal service over the network. This service, which uses a hard-coded secret for authentication, allows unauthenticated remote attackers to forge valid JWT tokens. By crafting a specific token, an attacker can bypass authentication and gain an interactive root shell.
- No authentication required.
- Forged JWT token for root shell.
- Remote unauthenticated root shell access.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could allow an unauthenticated remote attacker to gain full root access to the server by forging authentication tokens for the WebTerminal service. This access is possible when the WebTerminal FastAPI SSH service is exposed externally on port 8888.
- Server command execution.
- Unauthenticated remote network access.
- Complete server compromise.
Operational Fix
Recommended remediation, mitigation, and detection steps
The CyberPanel WebTerminal service presents a critical risk, potentially allowing unauthenticated remote attackers to gain a root shell. This impacts system administrators and infrastructure teams responsible for the hosting environment, as well as potentially vendor management if CyberPanel is a managed service. The immediate priority is to identify all instances of CyberPanel, confirm if the WebTerminal service on port 8888 is exposed externally and accessible, and then assess business criticality to prioritize remediation efforts.
- Identify CyberPanel instances, confirm exposure and criticality.
- Confirm responsible team ownership for remediation.
- Plan and execute immediate mitigation or patching.
