CWPdoor backdoor hides inside a trojanized cwpsrv binary on Control Web Panel servers

Researchers at XLab, the security research arm of QiAnXin Technology Group, have described a Linux backdoor they call CWPdoor, delivered by a trojanized copy of cwpsrv, the web server behind the Control Web Panel (CWP) management interface. BleepingComputer reported the findings on November 5.

CWP, formerly CentOS Web Panel, is an open-source hosting admin panel in the same slot as cPanel and Plesk. XLab says more than 340,000 CWP instances have been exposed on the public web over the past month.

The researchers caught a script posing as an updater that replaced the legitimate cwpsrv binary with a malicious one, covering the swap by restoring file and directory timestamps, deleting temporary files and wiping the command-history log. The script replaces cwpsrv versions 1.15.10 and 1.24.0.

CWPdoor sits dormant until someone sends a crafted request carrying an encrypted HTTP header, X-Ngx-Integrity-Data, alongside a timestamp header and an RSA signature header. The backdoor checks the timestamp against a five-minute window, verifies the signature, then decrypts the command with AES-256-CBC and hands it to a helper process. It also interferes with the logging module so the triggering request never reaches the access logs.

XLab found the initial script on June 29. Later, on September 30, it saw CWPdoor uploaded to VirusTotal in an archive that also held the Ebury backdoor, with the malicious cwpsrv file drawing zero detections. The link between the two is unclear, and nobody has said how many hosts are infected.

Administrators can look for the ngx_http_integrity_helper Unix socket, suspicious cwpsrv helper processes and X-Ngx-Integrity strings in the server binary. On a confirmed compromise, XLab's advice is to replace the binary with a legitimate copy, upgrade, rotate all control panel credentials and hunt the host for other malware. We'd start with the socket check, since it's cheap and doesn't need a reboot.