Control Web Panel (CWP) cwpsrv trojanized with CWPdoor Linux backdoor that hides commands from logs

What happened

Researchers at XLab, the research arm of QiAnXin Technology Group, found a Linux backdoor named CWPdoor. Attackers distribute it as a trojanized version of cwpsrv, the web server behind the Control Web Panel (CWP) management interface (BleepingComputer). CWP, formerly CentOS Web Panel, is an open-source hosting administration panel (BleepingComputer).

On June 29, XLab captured the installer, a shell script that poses as a version update. It replaces cwpsrv versions 1.15.10 and 1.24.0 with a backdoored build (The Hacker News). The installer needs root access, so the attackers must already control the server. The researchers do not yet know how attackers obtain that root access (The Hacker News). BleepingComputer does not mention the root requirement.

The script hides the swap. It restores file and directory timestamps, deletes temporary files and wipes command history (BleepingComputer). According to The Hacker News, this means ls and stat show the file as unchanged (The Hacker News).

The backdoor is passive. It behaves like normal cwpsrv until it receives a specially crafted request with three custom headers:

• X-Ngx-Integrity-Data carries an encrypted command.
• X-Ngx-Integrity-Time carries a timestamp.
• X-Ngx-Integrity-Sig carries an RSA signature.

Commands and their output are encrypted with AES-256-CBC. The timestamp must fall within a five-minute window and the signature must verify before the command runs. The backdoor also interferes with the logging module, so triggering requests do not appear in access logs (BleepingComputer).

On September 30, someone uploaded an archive containing the backdoor to VirusTotal. The Hacker News says the upload came from Brazil (The Hacker News). The archive also contained the Ebury backdoor, and the link between Ebury and CWPdoor is unclear (BleepingComputer). The researchers say different attackers may have planted the two on the same server (The Hacker News).

The backdoored file had zero detections on VirusTotal. The Hacker News gives this as zero out of 63 (The Hacker News). XLab says more than 340,000 CWP instances were exposed on the public web over the past month (BleepingComputer). The number of infected servers is not confirmed.

The sources do not mention a CVE, and they do not describe any vulnerability in CWP as the entry point.

Am I affected?

You may be affected if you run CWP with cwpsrv 1.15.10 or 1.24.0, because the installer handles only those versions (The Hacker News). XLab gives three checks (The Hacker News):

• Socket check. Run ss -axp | grep integrity. A result naming ngx_http_integrity_helper is a sign of infection. In XLab’s example, this check found the backdoor on a server where the list of open ports looked normal.
• Process check. Run ps aux | grep cwpsrv and look for unexpected helper processes started by cwpsrv.
• Binary check. Run strings /usr/local/cwpsrv/bin/cwpsrv | grep X-Ngx-Integrity and look for the backdoor’s header names.

XLab published these indicators (The Hacker News):

• MD5 e505d4ffa21cf494a5dc2d7c8f4f1236, installer script cwpsrv_update.sh
• MD5 965aea67fb40de1bab5169ada993349f, backdoored cwpsrv 1.15.10
• MD5 d3f4e95113d49ab3991b45e457bda75b, backdoored cwpsrv 1.24.0
• Download server IP 136.0.141[.]71, serving /static/cwpsrv_update.sh, /static/cwpsrv_1.15.10 and /static/cwpsrv_1.24.0

Do not rely on file timestamps, because the installer resets them.

What to do now

1. Run the socket, process and binary checks above on every CWP server, and compare the MD5 hash of the cwpsrv binary against the indicators.
2. If a server is infected, restore the original cwpsrv. The installer creates a backup in /usr/local/cwpsrv/bin whose name starts with cwpsrv.prev- and ends in a date and time. XLab says the installer deletes the backup after a successful swap, so it may be missing. If it is, replace the backdoored binary with a legitimate copy (The Hacker News, BleepingComputer).
3. Upgrade CWP to the latest version, then confirm that ss -axp | grep integrity returns nothing. A specific fixed version is not confirmed.
4. Rotate all control panel credentials, because the backdoor can run any command.
5. Treat the whole server as compromised and investigate it for other malware, including Ebury (The Hacker News).

Sources

• BleepingComputer: Hackers backdoor Linux servers using trojanized CWP web server
• The Hacker News: Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs