Executive brief
mdserver-web, a Linux server management panel, contains a critical security flaw that allows unauthorized individuals to take full control of the server. By exploiting unprotected interfaces, an attacker can modify and execute scheduled system tasks without needing a username or password. This can lead to complete data theft, service disruption, and the installation of malicious software.
Technical details
A remote command execution (RCE) vulnerability exists in mdserver-web due to missing authorization (CWE-862) and improper command neutralization (CWE-78). The '/modify_crond' and '/start_task' interfaces in 'web/admin/crontab/__init__.py' do not require authentication. An attacker can send a crafted POST request to modify existing scheduled tasks (which use predictable auto-incrementing IDs) and inject arbitrary shell commands into the task body. By subsequently calling the start interface, the attacker can execute these commands with the privileges of the web panel, leading to full system compromise.
Affected products
- midoks mdserver-web 0.18.0 - 0.18.4
Timeline
- 2026-05-02: advisory: GitHub Security Advisory published by vendor
- 2026-05-14: disclosed: CVE published to NVD