Severity: High | Priority: 1
CWPdoor is a newly discovered Linux backdoor hidden inside Control Web Panel (CWP), a free hosting control panel widely used to manage web, mail and DNS services on Linux servers. More than 340,000 CWP installations are reachable from the internet. Instead of installing a separate malicious program, the attackers replace cwpsrv, the panel’s own web server binary, with a modified copy. The infected server keeps working normally and looks legitimate. The backdoor is built into the web server as an extra module, and it reports each successful infection back to the attacker’s server.
The backdoor is passive: it opens no network connection of its own and stays silent until the attacker contacts it. To activate it, the attacker sends an ordinary-looking web request to the panel carrying three special headers. One holds a timestamp, one an encrypted command, and one a digital signature. The backdoor checks the signature against a key embedded in the binary and rejects any request older than five minutes. That means only the attacker can control it, and recorded requests can’t be replayed. Valid commands are run through a hidden helper process with root privileges, and the results go back to the attacker in encrypted form. The backdoor also stops these requests from being written to the web server’s access log, and the installer restores the original file timestamps and erases its traces from the shell history.
Administrators running CWP should check every server as root:
A clean result does not prove a server is safe, because the attackers may recompile the backdoor. On any affected server, replace the binary with a verified original and upgrade CWP to the latest release. Rotate all panel, SSH and application credentials, and treat the whole host as compromised. Rebuilding it from a known-good image is the safest option. To reduce exposure, restrict CWP’s administration ports to a VPN or a list of trusted IP addresses, and monitor the panel’s binaries for unexpected changes.