cPanel Releases Fixes for High-Severity Flaw Enabling Root-Level Compromise

En bref

• Vendor cPanel fixed a high-severity security defect on September 22.
• The flaw could permit root-level code execution and total server takeover.
• Attackers could also alter databases belonging to other hosting accounts.
• Affected components include cPanel itself, CalDAV, CardDAV, and WP Toolkit.
• No CVE identifier has been assigned to this vulnerability.

On September 22, the cPanel team disclosed a security defect and issued patches. The problem affects several components: the main cPanel interface, CalDAV, CardDAV, and the WP Toolkit. No CVE identifier was assigned to this issue.

The vulnerability permits an attacker to run arbitrary commands with root privileges, which grants complete control over the server. Moreover, this vulnerability permits altering databases owned by different accounts on the same computer. This is particularly dangerous in shared hosting environments where many customers' data is stored.

Any organization that uses cPanel to manage hosting accounts is at risk. For K-12 schools and government agencies, this includes websites, email services, and web applications hosted on cPanel-based infrastructure. Even if a school does not run cPanel directly, its third-party hosting provider might.

The severity is high because root access can lead to full compromise, data theft, and lateral movement. Since patches are available, immediate action is critical. Administrators should update cPanel and related components, review logs for suspicious activity, and monitor for unusual database changes. The exposure window is significant, so vigilance is warranted.

À faire maintenant

1. Apply the latest cPanel updates and patches for CalDAV, CardDAV, and WP Toolkit without delay.
2. Confirm that your hosting provider has installed the fixes if you rely on managed services.
3. Inspect server logs for unauthorized root-level commands or unexpected database alterations.
4. Limit access to cPanel interfaces to trusted IP ranges and enable multi-factor authentication.
5. Monitor hosting accounts for any cross-account database modifications or other anomalous activity.
6. If you suspect compromise, isolate the affected server and initiate a forensic review.
7. Subscribe to cPanel security advisories to stay informed about future patches.

Source originale

The Hacker News