CentOS Exploit Recent News and Vulnerabilities (2025)
Critical unauthenticated RCE in CentOS Web Panel (CWP), a widely used free control panel for managing CentOS servers. The flaw stems from two key issues: an authentication bypass in the file management system (removing user identifiers from URLs allows access without credentials) and command injection in the t_total parameter (lacks input sanitization, enabling shell command execution via chmod calls). Attackers can exploit this by sending crafted curl requests with reverse shell payloads—no authentication or root access required.
Vulnerability in the KSMBD (kernel-level SMB server) subsystem that allows unauthenticated remote attackers to exhaust server resources by sending thousands of incomplete TCP SYN requests. This denies legitimate SMB traffic (file sharing, authentication) by consuming all available connection slots.
handshake_timeout, limit backlog connections).Flaw in the Enhanced Transmission Selection (ETS) queue discipline (used for network bandwidth scheduling) that enables arbitrary kernel memory writes via a “use-after-free” condition. Attackers can exploit this to escalate privileges to root by constructing a reliable exploit chain using cross-cache attacks and heap spraying.
Vulnerability in libblockdev (a Linux block device management library) that omits the nosuid security flag when mounting partitions. This allows attackers with allow_active permissions (e.g., local users) to execute files with root privileges from mounted volumes.
libblockdev to versions that explicitly add nosuid and nodev flags during mount operations.Real-world attack on a CentOS server involving brute-force login, command replacement, and persistent backdoors. Attackers gained access by cracking weak SSH credentials, replaced the /usr/bin/ps command with a malicious ELF file to hide processes, and created a scheduled cron job (/root/shell.elf) to maintain persistence.
