Possible CWP Security Issue – Malicious JavaScript Injection

For a while, I’m going to check the `/home` directory daily for files modified within the last 24 hours. Since my server has relatively few users but receives a high number of attacks, I’m more likely to notice suspicious activity. If I find anything suspicious, I’ll share it here.

This is the command I’m using:

Code: [Select]

find /home -type f -cmin -1440
-printf '%TY-%Tm-%Td %TH:%TM:%TS %p\n' 2>/dev/null |
grep -v 'sess_' |
sort -r

(...)

Same issue here, with Iang.php and ur1.php files.

What's the fix for these attacks? Just delete files?
Was not clear if this was created using FileManager vulnerability. Is this correct?

Various sites affected here.
Backups was disabled too, withoout any command.
Some Nodejs apps was down too, no reason.

Distro is Centos 8 Stream.


Thanks!

The issue lay with the file manager. The attacker used the DELETE method to send a request containing a long string, appended a semicolon (";"), and executed a series of commands with root privileges. I was able to confirm—based on the attack timestamp, the timestamps of the injected files, and log entries the attacker failed to delete—that this was the method used.

Therefore, you should restrict the DELETE method by adding the following configuration to your `/usr/local/cwpsrv/conf/cwpsrv.conf` file, placing it between the `server {` and `location / {` directives:

Code: [Select]

# Natively block unauthorized methods in NGINX
if ($request_method !~ ^(GET|HEAD|POST)$ ) {
        return 444; # Code 444 closes the connection immediately without sending headers, saving bandwidth and dropping the bot
}

Additionally, you should disable the file manager:

Code: [Select]

mv /usr/local/cwpsrv/var/services/user_files/modules/filemanager.php{,.disabled}

The attacker exploited the file manager to gain root access to the server using a standard user account. Consequently, you should also remove the following configuration block wherever it appears:

Code: [Select]

location ~ ^/~(.+?)(/.*)?$ {
        internal;
        proxy_pass http://IP.AD.DR.ESS:8181;
        include proxy.inc;
}

However, there is no guarantee that it did not access your information and collect any sensitive or confidential data from your server. You should take measures to mitigate the impact of the server data compromise, should such an event have occurred.

Regards,
Netino

(...)

Same issue here, with Iang.php and ur1.php files.

What's the fix for these attacks? Just delete files?
Was not clear if this was created using FileManager vulnerability. Is this correct?

Various sites affected here.
Backups was disabled too, withoout any command.
Some Nodejs apps was down too, no reason.

Distro is Centos 8 Stream.


Thanks!

The issue lay with the file manager. The attacker used the DELETE method to send a request containing a long string, appended a semicolon (";"), and executed a series of commands with root privileges. I was able to confirm—based on the attack timestamp, the timestamps of the injected files, and log entries the attacker failed to delete—that this was the method used.

Therefore, you should restrict the DELETE method by adding the following configuration to your `/usr/local/cwpsrv/conf/cwpsrv.conf` file, placing it between the `server {` and `location / {` directives:

Code: [Select]

# Natively block unauthorized methods in NGINX
if ($request_method !~ ^(GET|HEAD|POST)$ ) {
        return 444; # Code 444 closes the connection immediately without sending headers, saving bandwidth and dropping the bot
}

Additionally, you should disable the file manager:

Code: [Select]

mv /usr/local/cwpsrv/var/services/user_files/modules/filemanager.php{,.disabled}

The attacker exploited the file manager to gain root access to the server using a standard user account. Consequently, you should also remove the following configuration block wherever it appears:

Code: [Select]

location ~ ^/~(.+?)(/.*)?$ {
        internal;
        proxy_pass http://IP.AD.DR.ESS:8181;
        include proxy.inc;
}

However, there is no guarantee that it did not access your information and collect any sensitive or confidential data from your server. You should take measures to mitigate the impact of the server data compromise, should such an event have occurred.

Regards,
Netino

Thanks! I'll block.

The attack happened again. I got a process running called "-cpanel" conecting to ip 152.53.173.29, from Germany.

Cannot confirm if it comes from filemanager.

Thanks!

After long time researching and testing, confirmed that server was a processe called "-cpanel" that connects to IP 152.53.173.29.
That files mentioned earlier in this thread was found in home directories with root permissions. All deleted.
IP was blocked and connections was closed.
Server infected, probably some was not updated. It's a Centos 8 Stream.
Will be reinstalled.

This problem was caused due a Centos without updates, but, CWP needs to be fixed too due a vulnerabilities mentioned by Netino.

Just posting here cause someone facing same problem.

Thanks!

This is a complete joke. Multiple servers hacked and with leftovers from previouse CVEs in CWP, and NO ONE from the team makes a announce about it or tell us something....

I believe there is a vulnerability in the User Portal wordpress_manager module and or addons module/wp_autologin feature.

I've been watching for sh command execution using falco. I got notified today that two of my CWP user accounts ran

Code: [Select]

sh -c chown : /home/username/public_html/cwp_login_xxxxx.php
And there were new cwp_login_xxxxx.php files created in both these user directories.
I guess these kinds of files are generated by CWP to allow the user to bypass their Wordpress login. Idk, never used that feature.
I'm the only one that has access to these users, and this was triggered from an IP I don't use.

Code: [Select]

155.117.252.20And these sites don't have Wordpress, or any active website for that matter, so impossible for an attack to have come through Wordpress.

I did this to check around the time that the cwp_login files were created.

Code: [Select]

grep -E "16:1[4-6]:" /usr/local/cwpsrv/logs/access_log
And got this:

Code: [Select]

155.117.252.20 - - [03/Sep/2026:16:15:15 -0600] "POST /user1/index.php?module=addons&act=wp_autologin HTTP/1.1" 302 89 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
155.117.252.20 - - [03/Sep/2026:16:15:15 -0600] "POST /user1/index.php?module=wordpress_manager&acc=list_domains HTTP/1.1" 302 160 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
155.117.252.20 - - [03/Sep/2026:16:15:15 -0600] "POST /user2/index.php?module=addons&act=wp_autologin HTTP/1.1" 302 90 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
155.117.252.20 - - [03/Sep/2026:16:15:15 -0600] "POST /user2/index.php?module=wordpress_manager&acc=list_domains HTTP/1.1" 302 160 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
155.117.252.20 - - [03/Sep/2026:16:15:16 -0600] "POST /user2/index.php?module=wordpress_manager&acc=list_domains HTTP/1.1" 302 160 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
155.117.252.20 - - [03/Sep/2026:16:15:16 -0600] "POST /user2/index.php?module=wordpress_manager&acc=scan_installations HTTP/1.1" 302 121 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
155.117.252.20 - - [03/Sep/2026:16:15:17 -0600] "POST /user2/index.php?module=domains&acc=dirlist HTTP/1.1" 302 12 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
155.117.252.20 - - [03/Sep/2026:16:15:17 -0600] "POST /user2/index.php?module=wordpress_manager&acc=list_domains HTTP/1.1" 302 160 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
155.117.252.20 - - [03/Sep/2026:16:15:18 -0600] "POST /user2/index.php?module=domains&acc=dirlist HTTP/1.1" 302 12 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
155.117.252.20 - - [03/Sep/2026:16:15:18 -0600] "POST /user2/index.php?module=domains&acc=dirlist HTTP/1.1" 302 12 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
155.117.252.20 - - [03/Sep/2026:16:15:18 -0600] "POST /user2/index.php?module=letsencrypt&acc=list HTTP/1.1" 302 14 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
155.117.252.20 - - [03/Sep/2026:16:15:19 -0600] "POST /user2/index.php?module=addons&act=wp_autologin HTTP/1.1" 302 90 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
155.117.252.20 - - [03/Sep/2026:16:15:19 -0600] "POST /user2/index.php?module=git_manager&acc=list_repos HTTP/1.1" 302 12 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
155.117.252.20 - - [03/Sep/2026:16:15:20 -0600] "POST /user2/index.php?module=addons&act=wp_autologin HTTP/1.1" 302 94 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
155.117.252.20 - - [03/Sep/2026:16:15:21 -0600] "POST /user1/index.php?module=wordpress_manager&acc=list_domains HTTP/1.1" 302 160 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
155.117.252.20 - - [03/Sep/2026:16:15:21 -0600] "POST /user1/index.php?module=wordpress_manager&acc=scan_installations HTTP/1.1" 302 121 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
155.117.252.20 - - [03/Sep/2026:16:15:22 -0600] "POST /user1/index.php?module=domains&acc=dirlist HTTP/1.1" 302 12 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
155.117.252.20 - - [03/Sep/2026:16:15:22 -0600] "POST /user1/index.php?module=wordpress_manager&acc=list_domains HTTP/1.1" 302 160 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
155.117.252.20 - - [03/Sep/2026:16:15:23 -0600] "POST /user1/index.php?module=domains&acc=dirlist HTTP/1.1" 302 12 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
155.117.252.20 - - [03/Sep/2026:16:15:23 -0600] "POST /user1/index.php?module=domains&acc=dirlist HTTP/1.1" 302 12 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
155.117.252.20 - - [03/Sep/2026:16:15:24 -0600] "POST /user1/index.php?module=addons&act=wp_autologin HTTP/1.1" 302 89 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
155.117.252.20 - - [03/Sep/2026:16:15:24 -0600] "POST /user1/index.php?module=git_manager&acc=list_repos HTTP/1.1" 302 12 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
155.117.252.20 - - [03/Sep/2026:16:15:24 -0600] "POST /user1/index.php?module=letsencrypt&acc=list HTTP/1.1" 302 14 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
155.117.252.20 - - [03/Sep/2026:16:15:25 -0600] "POST /user1/index.php?module=addons&act=wp_autologin HTTP/1.1" 302 93 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
These times lineup exactly when falco logged that "sh -c chown : /home/user1/public_html/cwp_login_xxxxxx.php" was ran so somehow this IP was able to POST data in a way that bypassed auth and allowed these wordpress login bypass files to be created by CWP.

I would block access to 2082 & 2083, (obvs admin 2086 / 2087 and 2030 / 2031, and API 2304 should already be whitelist only) until CWP can release a patch.