CVE-2024-24320: 
CloudPanel vulnerability analysis and mitigation

A Directory Traversal vulnerability has been identified in Mgt-commerce CloudPanel versions 2.0.0 through 2.4.0. The vulnerability allows remote attackers to obtain sensitive information and execute arbitrary code through the service parameter of the load-logfiles function. The vulnerability was disclosed on June 14, 2024, and has been assigned identifier CVE-2024-24320 (Datack Blog).

The vulnerability stems from an unfiltered parameter in the log file viewer functionality that enables path traversal attacks. This security flaw can be exploited to expose user session tokens, potentially leading to unauthorized access to websites and data. The issue has been addressed in version 2.4.1 of CloudPanel (Datack Blog).

The exploitation of this vulnerability can result in unauthorized access to sensitive information and potential arbitrary code execution. Additionally, attackers can obtain and hijack user session tokens, allowing them to gain unauthorized access to users' websites and associated data (Datack Blog).

Users are advised to upgrade to CloudPanel version 2.4.1, which contains the fix for this vulnerability (Datack Blog).