cwpdoor: Control Web Panel (CWP) — backdoored cwpsrv web server executes hidden commands via signed web requests
Severity: high · Patch status: unknown · Since 2026-11-05
QiAnXin XLab's CWPdoor report (published 2026-11-05) describes a trojanized cwpsrv web server binary used by Control Web Panel, a Linux hosting control panel. A root-level shell installer named cwpsrvupdate.sh, disguised as a version update, swaps in a replacement binary on cwpsrv versions 1.15.10 and 1.24.0 and restores the original file timestamps. The replacement binaries are served from an attacker-controlled IP, 136.0.141.71, not from a CWP download channel; XLab does not say how the installer first reaches a server. The implant runs commands carried in requests with X-Ngx-Integrity-Time, -Data and -Sig headers, which it checks by RSA signature and AES-encrypted payload, and it suppresses logging for those requests. XLab cites more than 340,000 CWP instances exposed to the internet in one month, but reports no infected-server count. Exploitation is XLab's inference: an archive holding the backdoor and an Ebury component was uploaded to VirusTotal from Brazil on 2026-09-30, and the backdoor sample had zero detections, which XLab reads as proof that real victims exist; the link between the two implants is unclear. No vendor response, fixed build or CISA KEV entry was found. Remediation: restore a cwpsrv.prev- backup if one exists, upgrade to the latest CWP, confirm no ngxhttpintegrityhelper unix socket remains, rotate panel credentials, and treat the host as fully compromised.
What to do
- Check for infection: run ss -axp | grep integrity (look for ngx_http_integrity_helper), ps aux | grep cwpsrv for unexpected helper processes, and strings /usr/local/cwpsrv/bin/cwpsrv | grep X-Ngx-Integrity
- Hunt egress, proxy and web logs for 136.0.141.71 and for the paths /static/cwpsrv_update.sh, /static/cwpsrv_1.15.10 and /static/cwpsrv_1.24.0
- If infected, restore the original cwpsrv from the cwpsrv.prev-* backup in /usr/local/cwpsrv/bin if it exists (XLab notes the installer deletes that backup after a successful health check)
- Upgrade CWP/cwpsrv to the latest version and confirm ss -axp | grep integrity returns nothing
- Rotate all control panel and server credentials, since the backdoor allows arbitrary command execution
- Treat the server as fully compromised and hunt for additional threats (e.g. Ebury) and persistence mechanisms
Sources
All live incidents on Threat Watch
