What Real Attackers Target in Hosting Panels

● 4 agents finished (ctrl+o to expand)
   ├─ Research hosting panel CVEs · 0 tool uses
   │  ⎿  Done
   ├─ Research Rust web app vulns · 0 tool uses
   │  ⎿  Done
   ├─ Research Docker/systemd/nginx attacks · 25 tool uses · 31.1k tokens
   │  ⎿  Done
   └─ Research React SPA + auth attacks · 0 tool uses
      ⎿  Done

● The research is done. Here's what I found and how I'd use it to properly audit a DockPanel.

Unauthenticated endpoints that shell out with user input. This single pattern led to widespread exploitation of CyberPanel (22,000 servers ransomwared in Oct 2024), CWP, VestaCP, and Webmin. It's also exactly what happened to DockPanel.

These are patterns I wouldn't have checked without this research:

  - Command environment inheritance — even with arg() arrays, LD_PRELOAD/PATH are inherited unless .env_clear() is used
  - systemd ExecStartPre/ExecStopPost/ExecReload injection — we fixed ExecStart but did we check all directive fields?
  - systemd drop-in directories — can a user create files in .service.d/ paths?
  - systemd timer/path unit persistence — can a user create timers or path watchers?
  - nginx $uri vs $request_uri — CRLF injection if $uri is used in redirects
  - nginx add_header inheritance — security headers silently disappear when a location block adds any custom header
  - Docker network_mode: host and pid: host in compose files
  - Docker env var substitution in compose — ${DB_PASSWORD} leaks host env
  - PostgreSQL COPY TO PROGRAM if connected as superuser
  - PostgreSQL search_path hijacking in the public schema
  - Mass assignment via serde if request DTOs aren't separated from DB models
  - WebSocket auth — often weaker than REST endpoint auth
  - Source maps in production build
  - javascript: URIs in any user-controlled href
  - Backup archive symlink attacks during restore

Proposed Audit Plan

I would run 5 parallel agents, each focused on one domain, armed with these specific checklists:

1. Agent routes + Command execution — check every Command::new() for env_clear(), absolute paths, argument injection. Check every systemd unit for all directives (not just ExecStart). Check compose file validation for privileged, network_mode, pid, volume mounts, env substitution.

2. Auth + API security — enumerate all routes, verify every one requires auth. Check for IDOR on every endpoint that takes an ID. Check JWT validation (fixed algorithm, expiration, revocation). Check CORS config. Check for mass assignment.

3. nginx config generation — check every generated config for alias traversal, $uri usage, header inheritance, location block bypass. Check domain validation.

4. PostgreSQL + data security — check connection privileges (superuser?), check for raw SQL interpolation, check backup/restore for symlink attacks, check credential storage.

5. Frontend (React) — check for source maps in build, dangerouslySetInnerHTML, JavaScript: hrefs, sensitive data in bundles, client-side auth bypasses, WebSocket auth.

Want me to run this audit now?