Researchers from QiAnXin's XLab have uncovered a stealthy backdoor lurking within the web server software of Control Web Panel, a popular tool for managing Linux hosting servers. This backdoor, dubbed 'cwpdoor', allows attackers to execute commands via web requests without generating access log entries. The installation of this backdoor requires root access, indicating that attackers must have already compromised the server.
The researchers discovered the installer for 'cwpdoor', a shell script masquerading as a version update, on June 29. This installer specifically targets two versions of the web server, cwpsrv 1.15.10 and 1.24.0. While it remains unclear how attackers gain the necessary root access, the presence of the backdoor was confirmed when an archive containing it was uploaded to VirusTotal from Brazil on September 30, suggesting that real-world infections have occurred.
The backdoor operates by modifying the cwpsrv software, embedding additional code that executes commands when requests with valid timestamps and signatures are received in custom headers. These headers begin with 'X-Ngx-Integrity'. Notably, the modification is stealthy, as file dates remain unchanged, making it difficult to detect through conventional checks. Despite its presence, initial scans showed zero detections on VirusTotal out of 63 attempts.
Further complicating matters, the Brazilian archive also contained Ebury malware, an OpenSSH backdoor and credential stealer active since 2009. The researchers have not confirmed a connection between the two, suggesting they might have been deployed by different attackers on the same server. This discovery highlights the need for vigilant monitoring and proactive security measures to protect Linux servers from such stealthy threats.
