DEV Community

yutianle
yutianle

Posted on

CloudPanel: 215,314 fingerprint matches, 106,200 exact titles, and 209,096 answers on one HTTPS port

#security #exposure

CloudPanel: 215,314 fingerprint matches, 106,200 exact titles, and 209,096 answers on one HTTPS port

CloudPanel is a hosting control panel focused on a small set of supported stacks. It manages sites, databases, certificates and system services from a web console, and its documentation describes the console as served over HTTPS on a dedicated port.

The four measurements

Collected on 2026-10-26, one result page per query, totals only:

  • app="CloudPanel" returned 215,314 matching assets.
  • title="CloudPanel" returned 215,314 matching assets.
  • title=="CloudPanel" returned 106,200 matching assets.
  • title="CloudPanel" && port="8443" returned 209,096 matching assets.
  • app="CloudPanel" && port="8443" returned 209,096 matching assets.

Two pairs are identical, and that deserves an explanation. The loose title query and the application fingerprint returned the same total. The port-scoped fingerprint and the port-scoped title query also returned the same total.

What identical counts mean

When two different query fields return the same number for a large population, one of three things is happening: the fields are being evaluated through a shared index in a way that produces the same matching set, the signature is so distinctive that both fields select the same assets, or one of the queries is effectively a subset relation that happens to be saturated.

In practice the first explanation is the most likely for identical totals at this scale, and the honest reporting decision is to say so and to rely on the measurements that differ. The strict title match, 106,200, is the one that behaves differently, and it behaves the way a strict string comparison should: it captures roughly half of the loose population, because exact equality rejects the pages whose title carries a suffix, a version, or a site name.

So the report treats 106,200 as the conservative count of consoles whose page title is exactly the product name, and 209,096 as the count of assets matching the product signature that answer on the console's HTTPS port.

The 209,096 number is a port decision

CloudPanel's console port is the interesting field. A panel that answers on its HTTPS port from a public address is a panel whose login form is reachable by anyone, and the population behind it is the set of sites, databases and certificates the panel manages.

The assets that match the product but do not answer on that port are the ones behind a proxy, on a non-default port, or observed through a certificate rather than a page. Their absence from the port-scoped count is a measurement artefact, not evidence that they are better secured.

Why panels dominate this class of exposure

Every control panel in this index shares a property: it exists to make privileged operations convenient, and convenience tends to win over network placement. A panel installed on a public address works immediately. A panel placed behind a VPN works after a configuration step and a support conversation.

The result is a population of consoles reachable from outside, each holding credentials that were entered into it: database users, DNS API keys, mail credentials, and the panel's own administrator password. That is the asset class worth inventorying, and the panel's fingerprint count is only a proxy for its size.

For an operator, the useful subset is the intersection of three lists: panels matching the product signature, panels answering on the console port, and panels in your own address space. The third list should be small and known, and the work is to make it so.

What to check on a panel that belongs to you

Is the console reachable from a network that needs it, and only that network? Proxy-level authentication in front of the console is a reasonable compensating control; the panel's own login is not, because it is the surface an attacker expects.

Are the credentials the panel stores rotatable? A panel holds a database root password and often a DNS provider key. Confirm both can be changed without breaking the sites they serve, and that the process has been executed at least once.

Does the panel have its own update path? A console that manages packages for the host usually has an opinion about its own version too, and a panel several releases behind is a single point of failure for every site behind it.

Detection

Two signals. A console login from an address that has no business reaching the panel is the strongest, and it requires the panel's authentication log to be forwarded. A change to the panel's configuration or its TLS certificate outside a planned window is the second, and it usually indicates either an unmanaged upgrade or someone else's access.

Externally, a quarterly check of your own address space against the product signature is enough. The population moves slowly, but it moves in the direction of more panels, not fewer.

Method and limits

All queries ran on 2026-10-26 with sub_type=all and pagesize=1; only the reported totals were used. Identical totals for different fields are reported as observed, without asserting which index behaviour produced them. Strict matching is case-sensitive and exact. Counts describe assets visible to the scanner, not deployments, not versions, and not authentication state.

References

Top comments (0)