Linux Control Panel Backdoored, Commands Executed Stealthily
A backdoor dubbed 'cwpdoor' has been discovered within the web server component of the popular Control Web Panel (CWP) for Linux, allowing attackers to execute commands without logging.
Researchers at QiAnXin's XLab have identified a sophisticated backdoor, named 'cwpdoor', embedded within the web server component of Control Web Panel (CWP), a widely-used free hosting management tool for Linux systems. This backdoor allows threat actors to execute arbitrary commands on compromised servers through specially crafted web requests, crucially bypassing the server's access logs and leaving minimal forensic traces.
The successful deployment of cwpdoor requires prior root access to the target system, suggesting that attackers must already have a significant level of control before they can implant the backdoor. The researchers captured the installer script, disguised as a version update, on June 29th. This installer specifically targets two versions of the CWP web server: cwpsrv 1.15.10 and 1.24.0. The exact method by which attackers gain the initial root access remains unknown.
Evidence of active exploitation has emerged, with an archive containing a copy of the backdoor being uploaded to VirusTotal from Brazil on September 30th. This upload indicates that "real victims already exist in the wild," although the exact number of compromised servers has not yet been determined. The backdoor itself is a modified version of the legitimate cwpsrv binary, rebuilt with additional malicious code. It functions normally until it receives a web request containing a valid timestamp and a signature within custom HTTP headers that begin with 'X-Ngx-Integrity'. Upon receiving such a request, the backdoor executes the command embedded within it.
To maintain stealth, the installer script replaces the original cwpsrv file and then resets the file's timestamps to their original values. This manipulation ensures that standard file integrity checks using commands like ls and stat do not flag the modified file as suspicious. During initial analysis, the backdoored file showed zero detections across 63 antivirus engines on VirusTotal, highlighting its evasion capabilities.
QiAnXin's XLab has provided several methods for system administrators to check for the presence of the cwpdoor backdoor. One method involves checking for a specific Unix socket used by the backdoor by running ss -axp | grep integrity and looking for 'ngx_http_integrity_helper'. Another approach is to examine running processes for unexpected helper processes initiated by cwpsrv using ps aux | grep cwpsrv. Finally, administrators can search for the backdoor's custom header names within the cwpsrv binary by running strings /usr/local/cwpsrv/bin/cwpsrv | grep X-Ngx-Integrity.
The researchers have also shared specific indicators of compromise, including MD5 hashes for the installer script and the two backdoored cwpsrv versions, along with an IP address (136.0.141[.]71) and associated URLs used for distributing the malicious files. These details are crucial for incident response and threat hunting efforts.
In the event of an infection, administrators are advised to restore the original cwpsrv binary from backups, upgrade to the latest CWP version, and verify the absence of the backdoor. Crucially, all control panel credentials should be reset, and the entire server should be treated as compromised, necessitating a thorough security audit for other potential threats. The investigation also noted the presence of the Ebury malware, an older OpenSSH backdoor, in the same archive, though its relation to cwpdoor remains unclear.