A backdoor has been found hiding in the web server that runs Control Web Panel (CWP), a free panel for managing Linux hosting servers, researchers at QiAnXin's XLab said this week.

The backdoored web server executes commands that attackers send via web requests, and those requests never appear in its access logs. Installing it takes root access, so the attackers must already control the server.

The researchers, who named the backdoor cwpdoor, captured its installer, a shell script posing as a version update, on June 29. The installer handles only two versions of that web server, cwpsrv 1.15.10 and 1.24.0. The researchers do not yet know how attackers get the root access the installer needs.

On September 30, an archive holding a copy of the backdoor was uploaded to VirusTotal from Brazil. The researchers say this indicates that "real victims already exist in the wild." They give no count of infected servers.

The backdoor is cwpsrv itself, rebuilt with extra code, the researchers found in their technical analysis. It behaves like the normal program until a request arrives with a valid timestamp and signature in custom headers whose names begin with X-Ngx-Integrity. It then runs the command carried in the request.

When the installer replaces the cwpsrv file, it puts the file's dates back to their original values, so checks with ls and stat show it as unchanged. When the researchers checked, the backdoor file had zero detections out of 63 on VirusTotal.

In the researchers' example, the socket check found the backdoor on a server where the list of open ports looked normal.

Source link