Ethical Hacking News
A critical backdoor has been discovered in the Control Web Panel (CWP) server, a popular tool for managing Linux hosting servers. The backdoor, named cwpdoor, allows attackers to execute arbitrary code on the compromised server, without leaving any logs. This revelation highlights the growing threat landscape of Linux hosting servers and emphasizes the need for administrators to remain vigilant in protecting their systems from malicious attacks.
The Control Web Panel (CWP) server has a backdoor, named cwpdoor, that can execute arbitrary code on compromised servers. The backdoor is hidden in a shell script that poses as a version update and can be difficult to detect. The backdoor can be identified by checking for specific files, processes, and socket connections. Administators can mitigate the risk of infection by restoring the original cwpsrv file, upgrading to the latest version, and changing credentials. The discovery highlights the importance of staying up-to-date with security patches and monitoring system logs for suspicious activity.
The recent discovery of a backdoor hidden within the Control Web Panel (CWP) server has sent shockwaves throughout the cybersecurity community. This revelation highlights the growing threat landscape of Linux hosting servers and the need for administrators to remain vigilant in protecting their systems from malicious attacks.
CWP is a free panel for managing Linux hosting servers, and its widespread adoption has made it an attractive target for hackers. Researchers at QiAnXin's XLab discovered the backdoor, named cwpdoor, by capturing its installer, a shell script posing as a version update, on June 29. The installer, which handles only two versions of the web server (cwpsrv 1.15.10 and 1.24.0), is designed to execute commands that attackers send via web requests, without leaving any logs. This characteristic makes it extremely difficult for administrators to detect and respond to the attack.
The backdoor, rebuilt with extra code, behaves like a normal program until a request arrives with a valid timestamp and signature in custom headers whose names begin with X-Ngx-Integrity. It then runs the command carried in the request, effectively allowing attackers to execute arbitrary code on the compromised server. When the installer replaces the cwpsrv file, it puts the file's dates back to their original values, making it challenging to detect the backdoor using traditional methods.
To identify the presence of the backdoor, researchers have developed a set of checks, including:
1. Socket: The Unix socket used by the backdoor, named ngx_http_integrity_helper, can be detected by running the command `ss -axp | grep integrity`.
2. Process: Unexpected helper processes started by cwpsrv can be detected by running the command `ps aux | grep cwpsrv`.
3. File: The backdoor's header names, which include X-Ngx-Integrity, can be detected by running the command `strings /usr/local/cwpsrv/bin/cwpsrv | grep X-Ngx-Integrity`.
The researchers have also published the indicators for the backdoor, including the MD5 hashes of the installer script and the backdoored cwpsrv files, as well as the IP address and URL of the download server.
To mitigate the risk of infection, administrators are advised to follow three steps:
1. Restore the original cwpsrv file from the backup created by the installer.
2. Upgrade to the latest version of the web server and confirm that the backdoor is no longer present.
3. Change all control panel credentials and treat the whole server as compromised, checking it for other threats.
The discovery of the CWP server backdoor highlights the importance of staying up-to-date with the latest security patches and being vigilant in monitoring system logs for suspicious activity. Administrators are strongly advised to take immediate action to protect their Linux hosting servers from this threat.
Related Information:
https://www.ethicalhackingnews.com/articles/Unveiling-the-CWP-Server-Backdoor-A-Growing-Concern-for-Linux-Hosting-Server-Administrators-ehn.shtml
https://thehackernews.com/2026/11/hackers-hide-linux-backdoor-in-control.html
Published: Fri Nov 6 02:15:56 2026 by llama3.2 3B Q4_K_M
