CVE-2024-54679: CyberPanel Auth Bypass Vulnerability

CVE-2024-54679 Overview

CVE-2024-54679 affects CyberPanel, an open-source web hosting control panel. The vulnerability allows authenticated users without the FilemanagerAdmin capability to invoke the restartMySQL action. This missing authorization check [CWE-862] enables low-privileged users to restart the MySQL database service. Restarting the database interrupts hosted sites, databases, and dependent services. The flaw exists in versions of CyberPanel before commit 6778ad1. The vendor addressed the issue by moving the privilege check ahead of the restart operation in databases/views.py.

Critical Impact
Authenticated low-privileged CyberPanel users can trigger MySQL restarts, causing database availability loss across all hosted applications on the affected server.

Affected Products

CyberPanel versions prior to commit 6778ad1
CyberPanel self-hosted web control panel deployments
All CyberPanel-managed MySQL databases on affected instances

Discovery Timeline

2024-12-05 - CVE-2024-54679 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-54679

Vulnerability Analysis

The vulnerability stems from a missing authorization check in the CyberPanel restartMySQL view handler. The function executed mysqlUtilities.restartMySQL() before verifying the caller's Access Control List (ACL). Any authenticated session could reach the endpoint and restart the database engine. The attack vector is network-based and requires low privileges with no user interaction. The impact is limited to availability. Confidentiality and integrity of stored data are not directly affected.

Root Cause

The root cause is a broken access control pattern [CWE-862] in databases/views.py. The handler invoked the privileged restartMySQL utility before loading ACLManager.loadedACL(userID) and checking the admin or FilemanagerAdmin capability. The authorization logic ran after the sensitive action, defeating its purpose. The pre-patch code performed the restart on every request reaching the view.

Attack Vector

An attacker needs valid CyberPanel credentials for any account, including low-privileged tenant users. The attacker sends an authenticated HTTP request to the restartMySQL endpoint. The server executes the restart without validating capabilities. All MySQL-dependent sites and services on the host become unavailable until the database restarts. Repeated requests can be used to sustain denial-of-service conditions against hosted databases.

python

# Patched handler excerpt - databases/views.py
 def restartMySQL(request):
     try:
         userID = request.session['userID']
-        finalData = mysqlUtilities.restartMySQL()
         currentACL = ACLManager.loadedACL(userID)
 
         if currentACL['admin'] == 1:
# Source: https://github.com/usmannasir/cyberpanel/commit/6778ad1eaae41f72365da8fd021f9a60369600dc

The patch removes the unconditional mysqlUtilities.restartMySQL() call and relocates the restart action behind the ACL check, ensuring only authorized administrators can trigger it.

Detection Methods for CVE-2024-54679

Indicators of Compromise

Unexpected MySQL service restart events in system logs on CyberPanel hosts
Authenticated HTTP POST requests to the restartMySQL endpoint from non-administrator user sessions
Short-duration database connectivity errors reported by hosted applications
Spikes in MySQL mysqld process start events without corresponding administrator activity

Detection Strategies

Audit CyberPanel access logs for requests to the restartMySQL view and correlate the userID with assigned ACL roles
Compare the deployed CyberPanel commit hash against 6778ad1 to confirm whether the patched handler is in place
Enable Django request logging around databases/views.py to capture caller identity, source IP, and session metadata

Monitoring Recommendations

Alert on MySQL systemd restart events outside scheduled maintenance windows
Forward CyberPanel application logs to a centralized log platform for ACL-based correlation
Monitor for repeated availability failures on hosted databases that align with CyberPanel request patterns

How to Mitigate CVE-2024-54679

Immediate Actions Required

Update CyberPanel to a build that includes commit 6778ad1 or later
Review all non-administrator CyberPanel accounts and remove unused or shared credentials
Restrict network access to the CyberPanel administrative interface to trusted management networks
Rotate passwords for any low-privileged accounts that may have been shared or exposed

Patch Information

The fix is published in the upstream CyberPanel repository. See the CyberPanel security commit 6778ad1 for the authoritative change. Administrators should pull the latest main branch or an official release that contains this commit. Verify the deployed source matches the patched restartMySQL handler after upgrading. A proof-of-concept is published at the CVE-2024-54679 PoC repository.

Workarounds

Block external access to the CyberPanel web interface using a firewall or reverse proxy allow-list until the patch is applied
Temporarily remove or disable low-privileged CyberPanel accounts that do not require database management
Place a web application firewall rule in front of the CyberPanel endpoint to deny requests to restartMySQL from non-admin sessions

bash

# Example: restrict CyberPanel admin port to a management subnet
sudo ufw default deny incoming
sudo ufw allow from 10.0.0.0/24 to any port 8090 proto tcp
sudo ufw reload