cPanel and WebHost Manager (WHM) hit by a serious security flaw

mood · Nov 24, 2020

cPanel and WHM hit by a serious security flaw
Two-factor authentication bypass flaw could affect over 70m websites
November 24, 2020
https://www.techradar.com/news/cpanel-and-whm-hit-by-a-serious-security-flaw

A previously undisclosed vulnerability in the web hosting control panel cPanel as well as the company's WebHost Manager (WHM) has been discovered by the vulnerability and threat management firm Digital Defense.

cPanel and WHM are a suite of Linux tools that allow hosting providers and their customers to automate server management and other web hosting related tasks. cPanel has served the global hosting community for more than 20 years and over 70m domains have been launched using its software.
Click to expand...

The vulnerability, discovered by Digital Defense which affects cPanel and WHM version 11.90.05 (90.0 Build 5), is a two-factor authentication bypass flaw that can be exploited by brute force attacks. As a result, an attacker with knowledge of or access to valid credentials could bypass two-factor authentication protections on a user's cPanel or WHM account.

CPanel provided further details on the vulnerability in a recent security advisory, saying:

“The two-factor authentication cPanel Security Policy did not prevent an attacker from repeatedly submitting two-factor authentication codes. This allowed an attacker to bypass the two-factor authentication check using brute force techniques. Failed validation of the two-factor authentication code is now treated as equivalent to a failure of the account’s primary password validation and rate limited by cPHulk.”
Click to expand...

mood · Aug 11, 2021

Web hosting platform cPanel & WHM is vulnerable to authenticated RCE and privilege escalation
Pen testers and vendor disagree over appropriate mitigations
August 11, 2021
https://portswigger.net/daily-swig/...thenticated-rce-nbsp-and-privilege-escalation

Security researchers have achieved remote code execution (RCE) and privilege escalation on web hosting platform cPanel & WHM via a stored cross-site scripting (XSS) vulnerability.
cPanel & WHM is a suite of Linux tools that enable the automation of web hosting tasks via a graphical user interface (GUI). cPanel is used in the hosting of more than 168,000 websites, according to Datanyze.

During a black-box pen test, RCE was also demonstrated via a “more convoluted” CSRF bypass chained with a cross-site WebSocket hijacking attack that was possible because WebSockets failed to check their requests’ Origin header, according to a technical write-up published by Adrian Tiron, cloud AppSec consultant at UK infosec firm Fortbridge.
Click to expand...

MULTIPLE VULNERABILITIES IN CPANEL/WHM

A (failed) XXE
By navigating through cPanel, we realized that there was a link which allowed us to redirect to WHM, with the same limited privileges that we had. We have not encountered this configuration previously, so this was something new to us and the main benefit was that it has obviously increased our attack surface.
Privilege escalation via stored XSS
Whilst scratching our heads, trying to exploit the previous XXE, we have found out that the XML file contained many “key” attributes which were displayed back to the user. So, could it be possible that we have found a stored XSS vulnerability?
No origin check for WebSockets
cPanel/WHM support web terminals which basically allows you to execute commands on the server in a ssh-like manner. So, I was wondering how’s this implemented? [...]
Click to expand...

Log in or Sign up

cPanel and WebHost Manager (WHM) hit by a serious security flaw

mood Updates Team

mood Updates Team