Researchers at QiAnXin’s XLab recently discovered a hidden backdoor within the Control Web Panel (CWP) server, a popular tool for managing Linux hosting environments. This backdoor, known as cwpdoor, allows attackers to execute commands without leaving any trace in the server’s access logs. The discovery raises significant concerns about the security of servers using this free management panel.
How the Backdoor Evades Detection
The cwpdoor backdoor operates by intercepting web requests, which are not recorded in the server’s logs, thus avoiding detection. The installation of this malicious software requires root access, suggesting that attackers must already have substantial control over the targeted system. QiAnXin’s researchers identified the backdoor on June 29, posing as a legitimate shell script update for the web server’s versions cwpsrv 1.15.10 and 1.24.0. The method attackers use to gain initial root access remains unclear.
Further evidence of the backdoor’s presence came to light on September 30 when an archive containing the malicious software was uploaded to VirusTotal from Brazil. The lack of detection by security systems indicates that real-world infections are likely, although the exact number of compromised servers is unknown.
Technical Analysis and Identification
The backdoor is integrated directly into the cwpsrv program, reconstructing it with additional code. It functions normally until it receives a request with a specific timestamp and signature in custom headers starting with X-Ngx-Integrity. At that point, it executes the command included in the request. The backdoor’s installer is adept at hiding its tracks, as it resets the file dates to appear unchanged, even when checked with typical commands like ls and stat.
QiAnXin’s researchers provide several methods to detect the backdoor. They suggest checking for unusual Unix sockets using ss -axp | grep integrity and looking for unexpected processes with ps aux | grep cwpsrv. Additionally, scanning the cwpsrv binary for specific header names using strings /usr/local/cwpsrv/bin/cwpsrv | grep X-Ngx-Integrity can reveal potential infections.
Remediation and Preventative Measures
For those with servers potentially infected, the researchers advise restoring the original server software from backups, which the installer may have created. If backups are unavailable, upgrading to the latest version and ensuring no unusual integrity checks remain is crucial. Furthermore, they recommend changing all control panel credentials and treating the entire server as compromised to safeguard against further threats.
The analysis also uncovered the presence of Ebury malware, a known OpenSSH backdoor, within the same archive from Brazil. While the relationship between cwpdoor and Ebury remains speculative, the possibility of different attackers targeting the same servers cannot be ruled out. This discovery underscores the importance of maintaining rigorous security protocols on all server infrastructures.
