EN PT-BR
← Voltar ao feed
high hosting

CWPdoor backdoor hidden in Control Web Panel cwpsrv binary enables passive root command execution

1 fonte(s) · 1 atualização(ões) · publicado 10/11/2026 03:20 · coletado há 1 hora

QiAnXin XLab documented CWPdoor, a passive Linux backdoor compiled into cwpsrv, the Nginx-based web server of Control Web Panel (formerly CentOS Web Panel), a hosting panel with more than 340,000 internet-facing instances in the article's count. The implant reaches a host only after an attacker already holds root, through a fake updater script named cwpsrv_update.sh that swaps the genuine binary for a trojanized one. Once in place it waits for signed, encrypted commands carried in HTTP headers and removes its own traces from the access log. A backdoored build reached VirusTotal from Brazil on September 30, 2026, inside an archive that also held the Ebury SSH backdoor, but no attacker group is named and the initial access method is unknown. The backdoor has no CVE and no vendor patch addresses it (threatdefence.com), so the risk is concentrated on panels that are already compromised; the exposure figure counts possible targets, not infections.

Detalhes técnicos

  • The installer checks whether the local cwpsrv is version 1.15.10 or 1.24.0, downloads the matching trojanized ELF, backs up the genuine binary, stops the panel, overwrites the executable, and restarts the service.
  • It verifies that the master, worker and helper processes run after restart and rolls back if the check fails; on success it deletes the temporary files and the backup.
  • It restores the original access and modification times on the binary and its parent folder and clears the shell history, so routine checks with ls and stat appear to show the file was never modified.
  • The backdoor adds no listening TCP port. At startup it binds an abstract Unix domain socket named ngx_http_integrity_helper and spawns a child process titled "helper process".
  • Commands arrive in three custom headers: X-Ngx-Integrity-Time, X-Ngx-Integrity-Data and X-Ngx-Integrity-Sig. The timestamp must fall within a 300-second window, and the Base64 signature is checked against an embedded RSA-2048 public key that is stored XOR-masked with 0x55. Requests that fail either check are served as ordinary web traffic.
  • On success the master process derives an AES-256-CBC key from the SHA-256 hash of the RSA public key string, passes the decrypted command to the helper over the local socket, and runs it with popen. The AES-encrypted output returns in an HTTP 200 response.
  • The module context array is altered so the logging module is skipped, which leaves no entries in the web access logs for these requests.

Remediação

  • Isolate the server and replace the modified cwpsrv with a verified clean build; threatdefence.com recommends updating CWP to 1.30.3 or later and rebuilding or reinstalling the panel.
  • Check for the socket with ss -axp | grep integrity, look for an unexpected "helper process" child under cwpsrv, and scan the binary for X-Ngx-Integrity strings (threatdefence.com, citing XLab).
  • Audit the whole Linux host for secondary implants such as Ebury, because the installer deletes its own backup and requires root, so the entry point may not be visible.
  • Rotate all panel, database and SSH credentials from a clean workstation, and assume that any command the backdoor could run has been compromised.
  • No Fix Details section applies: the article describes malware planted after root access, not a flaw in the panel code.

Linha do tempo

  1. securityonline.info ↗ · pub. 10/11/2026 03:20 · coletado 10/11 04:00 primeiro registro

    CWPdoor backdoor hidden in Control Web Panel cwpsrv binary enables passive root command execution

    ler a análise desta fonte

    QiAnXin XLab documented CWPdoor, a passive Linux backdoor compiled into cwpsrv, the Nginx-based web server of Control Web Panel (formerly CentOS Web Panel), a hosting panel with more than 340,000 internet-facing instances in the article's count. The implant reaches a host only after an attacker already holds root, through a fake updater script named cwpsrv_update.sh that swaps the genuine binary for a trojanized one. Once in place it waits for signed, encrypted commands carried in HTTP headers and removes its own traces from the access log. A backdoored build reached VirusTotal from Brazil on September 30, 2026, inside an archive that also held the Ebury SSH backdoor, but no attacker group is named and the initial access method is unknown. The backdoor has no CVE and no vendor patch addresses it (threatdefence.com), so the risk is concentrated on panels that are already compromised; the exposure figure counts possible targets, not infections.

    Technical Details

    • The installer checks whether the local cwpsrv is version 1.15.10 or 1.24.0, downloads the matching trojanized ELF, backs up the genuine binary, stops the panel, overwrites the executable, and restarts the service.
    • It verifies that the master, worker and helper processes run after restart and rolls back if the check fails; on success it deletes the temporary files and the backup.
    • It restores the original access and modification times on the binary and its parent folder and clears the shell history, so routine checks with ls and stat appear to show the file was never modified.
    • The backdoor adds no listening TCP port. At startup it binds an abstract Unix domain socket named ngx_http_integrity_helper and spawns a child process titled "helper process".
    • Commands arrive in three custom headers: X-Ngx-Integrity-Time, X-Ngx-Integrity-Data and X-Ngx-Integrity-Sig. The timestamp must fall within a 300-second window, and the Base64 signature is checked against an embedded RSA-2048 public key that is stored XOR-masked with 0x55. Requests that fail either check are served as ordinary web traffic.
    • On success the master process derives an AES-256-CBC key from the SHA-256 hash of the RSA public key string, passes the decrypted command to the helper over the local socket, and runs it with popen. The AES-encrypted output returns in an HTTP 200 response.
    • The module context array is altered so the logging module is skipped, which leaves no entries in the web access logs for these requests.

    Remediation

    • Isolate the server and replace the modified cwpsrv with a verified clean build; threatdefence.com recommends updating CWP to 1.30.3 or later and rebuilding or reinstalling the panel.
    • Check for the socket with ss -axp | grep integrity, look for an unexpected "helper process" child under cwpsrv, and scan the binary for X-Ngx-Integrity strings (threatdefence.com, citing XLab).
    • Audit the whole Linux host for secondary implants such as Ebury, because the installer deletes its own backup and requires root, so the entry point may not be visible.
    • Rotate all panel, database and SSH credentials from a clean workstation, and assume that any command the backdoor could run has been compromised.
    • No Fix Details section applies: the article describes malware planted after root access, not a flaw in the panel code.