● Covered by 1 source · 1 reportMedium impact1 negative
Backdoor Found in Control Web Panel Server Allows Undetected Command Execution
Key points
- Backdoor found in cwpsrv, the web server for Control Web Panel (CWP).
- Executes commands from web requests without logging them.
- Requires root access for installation, disguised as a version update.
- Indicators of compromise and detection methods have been released.
Discovery of cwpdoor Backdoor
Researchers at QiAnXin's XLab identified a backdoor embedded in the web server that powers Control Web Panel (CWP), a free management panel for Linux hosting servers. The backdoor, dubbed cwpdoor, enables remote command execution on compromised servers.
Operational Mechanics
The backdoored web server executes commands sent by attackers through specific web requests. These malicious requests are designed to bypass standard logging mechanisms, meaning they do not appear in the server's access logs. Installation of the backdoor requires root access, implying attackers must already have control over the target server before deploying it.
The backdoor itself is a modified version of the cwpsrv program. It activates when a request contains a valid timestamp and signature within custom HTTP headers starting with 'X-Ngx-Integrity', subsequently running the command included in the request.
Infection Vector and Evidence
The installer for cwpdoor is a shell script disguised as a version update, captured on June 29. This installer targets specific versions of the cwpsrv web server: 1.15.10 and 1.24.0. The initial method attackers use to gain the necessary root access for installation remains unknown.
An archive containing the backdoor was uploaded to VirusTotal from Brazil on September 30, suggesting that servers have already been compromised in real-world scenarios. The backdoor file initially had zero detections across 63 antivirus engines on VirusTotal, and its installer manipulates file dates to appear unchanged after deployment.
Detection and Indicators of Compromise
XLab provided several methods to check for the backdoor's presence: inspecting for the 'ngx_http_integrity_helper' Unix socket, looking for unexpected helper processes spawned by cwpsrv, and grepping for 'X-Ngx-Integrity' strings within the cwpsrv binary. Indicators of compromise include specific MD5 hashes for the installer script and backdoored cwpsrv versions, along with a download server IP address and associated URLs.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Reporting from
Security researchers discovered a backdoor, named cwpdoor, hidden within the web server component of Control Web Panel (CWP), a Linux hosting management tool. This backdoor allows attackers to execute commands via web requests without leaving traces in access logs, indicating active exploitation in the wild.