LowEndBox - Cheap VPS, Hosting and Dedicated Server Deals

Report Reveals cPanel/WHM Suffers “Multiple Vulnerabilities”

Tags: , , , Date/Time: August 17, 2021 @ 12:00 pm, by raindog308

cPanelSecurity research firm Fortbridge has released a report claiming to have discovered “multiple vulnerabilities in cPanel/WHM”.

The report states:

“Our team has found multiple vulnerabilities in cPanel/WHM during a black-box pentest, the most important one being a privilege escalation via stored XSS. Whilst disclosing these bugs to the cPanel/WHM team, we discovered the pentested cPanel account was a reseller account with the permission to edit locales, thus this is not a default setting. The XSS vulnerability which we will present is considered a feature, and it was not fixed. We will show how this “feature” can be abused to escalate privileges to root, together with the rest of our findings.”

The report is quite detailed and shows in-depth the path they take to conduct the attack.

So what do you think – is this indeed a “feature” or is it a genuine bug?  cPanel has disputed the severity of this issue.

I'm Andrew, techno polymath and long-time LowEndTalk community Moderator. My technical interests include all things Unix, perl, python, shell scripting, and relational database systems. I enjoy writing technical articles here on LowEndBox to help people get more out of their VPSes.

No Comments

    Leave a Reply

    Some notes on commenting on LowEndBox:

    • Do not use LowEndBox for support issues. Go to your hosting provider and issue a ticket there. Coming here saying "my VPS is down, what do I do?!" will only have your comments removed.
    • Akismet is used for spam detection. Some comments may be held temporarily for manual approval.
    • Use <pre>...</pre> to quote the output from your terminal/console, or consider using a pastebin service.

    Your email address will not be published. Required fields are marked *