CVE-2021-37840: High severity aaPanel aaPanel vulnerability
aaPanel through 6.8.12 allows Cross-Site WebSocket Hijacking (CSWH) involving OS commands within WebSocket messages at a ws:// URL for /webssh (the victim must have configured Terminal with at least one host). Successful exploitation depends on the browser used by a potential victim (e.g., exploitation can occur with Firefox but not Chrome).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Prevent CSWH involving OS commands within WebSocket messages by ensuring the WebSocket endpoint for /webssh uses TLS (wss://) rather than plaintext ws://.
aaPanel /webssh WebSocket URL scheme (ws:// vs wss://) = Use wss:// instead of ws:// - Configuration
Reduce exposure by ensuring Terminal is not configured with any host on the victim side, since exploitation depends on the victim having configured Terminal with at least one host.
aaPanel Terminal configuration Configured Terminal hosts = At least one host should not be configured
Event History
Frequently Asked Questions
What is CVE-2021-37840?
CVE-2021-37840 is a vulnerability in aaPanel through version 6.8.12 that allows Cross-Site WebSocket Hijacking (CSWH) involving OS commands within WebSocket messages.
What is Cross-Site WebSocket Hijacking (CSWH)?
Cross-Site WebSocket Hijacking (CSWH) is an attack that allows an attacker to hijack a WebSocket connection established between a client and a server.
How does CVE-2021-37840 affect aaPanel?
CVE-2021-37840 affects aaPanel versions up to and including 6.8.12, allowing Cross-Site WebSocket Hijacking (CSWH) involving OS commands within WebSocket messages at a ws:// URL for /webssh.
What is the severity of CVE-2021-37840?
CVE-2021-37840 has a severity rating of 8.8, which is considered high.
How can I mitigate the vulnerability in aaPanel?
To mitigate the vulnerability in aaPanel, update to a version higher than 6.8.12.