Top web hosting platform could be easily exploited using these threats

Scammers
(Image credit: Pixabay)

Cybersecurity researchers have successfully conducted remote code execution (RCE) and privilege escalation attacks on popular web hosting control platform cPanel & WHM by exploiting a stored cross-site scripting (XSS) vulnerability.

While cPanel is limited to managing a single hosting account, cPanel & WHM allows admins to manage the entire server

“Our team has found multiple vulnerabilities in cPanel/WHM during a black-box pentest, the most important one being a privilege escalation via stored XSS,” shared Adrian Tiron, co-founder of cloud security firm Fortbridge. 

TechRadar needs you!

We're looking at how our readers use VPNs with streaming sites like Netflix so we can improve our content and offer better advice. This survey won't take more than 60 seconds of your time, and we'd hugely appreciate if you'd share your experiences with us.

>> Click here to start the survey in a new window <<

According to Tiron, the researchers were able to exploit the XSS vulnerability to escalate privileges to root.

Ripe for exploit

Whilst disclosing these bugs to the cPanel & WHM team, the Fortbridge team realized that the pentested cPanel account was a reseller account with the permission to edit locales, leading them to conclude that the XSS vulnerability discovered during their pestest “is considered a feature, and it was not fixed.”

The second bug is an HTML injection vulnerability. Although Tiron says this vulnerability is enough to bypass the CSRF/referrer leak protection, the process to exploit it is a lot more “convoluted.”

Fortbridge notified cPanel of the vulnerabilities earlier this year, and the popular control panel updated the relevant portions of its documentation earlier this month. 

However, cPanel hasn’t yet fixed the flaws, arguing that threat actors must be authenticated to exploit the vulnerability. 

In a conversation with The Daily Swig, Cory McIntire, product owner on the cPanel security team, said “the Locale interface can only be used by root and Super Privilege resellers to whom the root must grant this specific ACL to.”

He added that “this is labelled a Super Privilege with a warning icon in the server admins WHM interface, and also flagged as such in the cPanel documentation.”

In terms of protection, McIntire said that Super Privileges should only be given to people you would trust with root on your server.”

Mayank Sharma

With almost two decades of writing and reporting on Linux, Mayank Sharma would like everyone to think he’s TechRadar Pro’s expert on the topic. Of course, he’s just as interested in other computing topics, particularly cybersecurity, cloud, containers, and coding.

Read more
A person at a laptop with a cybersecure lock symbol floating above it.
Parallels Desktop has some worrying security flaws for Mac users
Wordpress brand logo on computer screen. Man typing on the keyboard.
Thousands of WordPress sites targeted with malicious plugin backdoor attacks
The best free firewall
Sophos hotfixes remote code execution vulnerabilities in Firewall
WordPress
Another top WordPress plugin found carrying critical security flaws
The best free firewall
Microsoft fixes Power Pages security flaw, tells users to be on their guard
Laptop computer displaying logo of WordPress, a free and open-source content management system (CMS)
Over a million WordPress sites exposed to attack from W3 Total Cache plugin flaw
Latest in Website Hosting
A cloud symbol imposed over a bank of servers in a data center.
What is cloud hosting and who needs it?
Dark web scanning on a laptop
Hostinger integrates dark web scanning into hPanel
WordPress
WordPress Foundation bid for greater trademark control halted, adding to more legal setbacks for CEO Matt Mullenweg
The PebbleHost website.
PebbleHost review
An image of the Cloudways Copilot logo
AI managed web hosting: I spoke to Cloudways about its new tool and the benefits artificial intelligence brings to servers
SPanel
As cPanel increases prices SPanel's improved compatibility could shake up the web hosting world order
Latest in News
Citroen 2CV
The retro EV resurgence is in full swing, as Citroen confirms the iconic 2CV will return with batteries
Hugging Snap
This AI app claims it can see what I'm looking at – which it mostly can
Apple iPhone 16 Pro Max REVIEW
The latest batch of leaked iPhone 17 dummy units appear to show where glass meets metal on the new designs
Hornet swings their weapon in mid air
Hollow Knight: Silksong could potentially launch this year and I reckon it could be a great game for an Xbox handheld
ransomware avast
Ransomware attacks are costing Government offices a month of downtime on average
Cassian looking at someone off-camera from a TIE fighter cockpit in Andor season 2
Star Wars: Andor creator is taking a stance against AI by canceling plans to release its scripts, and I completely get why