Linux Backdoor Found in Control Web Panel Server
Attackers embedded a stealthy backdoor in CWP's web server to run commands without leaving log traces. Root-level access was required for installation, indicating prior compromise.
TL;DR
- Researchers discovered a hidden Linux backdoor in Control Web Panel (CWP) servers.
- The backdoor executes attacker commands while evading access logs.
- Installation requires root access, suggesting initial server compromise.
- CWP is widely used for managing Linux hosting environments.
- Organizations using CWP should audit their installations immediately.
Security researchers at QiAnXin's XLab have uncovered a隐蔽 backdoor embedded within the web server component of Control Web Panel (CWP), a popular open-source tool for managing Linux hosting servers. This malicious code enables attackers to execute arbitrary commands remotely while avoiding detection by omitting entries from access logs.
The presence of such a backdoor indicates that attackers had already gained root-level access to install it, pointing to a previously compromised system. Organizations relying on CWP for server management should treat this as a critical indicator of potential exposure and take immediate steps to verify the integrity of their deployments.
Backdoor Technical Details
- The backdoor resides in the web server layer of Control Web Panel (CWP).
- It accepts commands through specially crafted HTTP requests.
- Executed commands do not appear in standard web access logs.
- Root privileges are necessary for deploying the backdoor.
- This suggests attackers had full system control before installation.
Impact and Recommendations
- Control Web Panel is commonly used in hosting environments.
- Compromised panels can lead to broader infrastructure attacks.
- Administrators should review CWP installations for unauthorized modifications.
- Verify file integrity using official checksums or re-install from trusted sources.
- Monitor systems for unusual command execution patterns or unexpected network traffic.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.