3 cPanel Vulnerabilities Found

Last Updated: November 30, 1999

What is cPanel & WHM?
cPanel & WebHost Manager (WHM) is a next generation web hosting control panel system. Both cPanel & WHM are extremely feature rich as well as include an easy to use web based interface (GUI).

Three New Vulnerabilities were found in the cPanel hosting control panel system. The security vulnerabilities ranged from reading other's files to changing any file permissions.

The three cpanel vulnerabilities were posted on BugTraq Oct. 18th, 2004 before being reported to cPanel. This unfortunately means that cPanel found out about the security flaw when the rest of the world did. cPanel had no time to release a fix for these vulnerabilities before malicious users begin executing them. As of 8:00pm PST Oct. 18th, 2004 cPanel has not released a fix for these vulnerabilities, however cPanel is working at full throttle to fix these issues.

The first vulnerability allows logged in users to read any file on the system, including files the user does not have permission to read or access.

The second cPanel vulnerability allows logged in users to change ownership of any file to their own user id and group id.

The third and final cPanel vulnerability allows logged in users to change the permission of any file to 755.

Did you notice something common in the above vulnerabilities? You probably noticed that the user must be logged into cPanel for any of these vulnerabilities to work. This means that unless you have added a malicious user to your system you are 'ok'. There are two problem with this however, one being if a users cPanel account is compromised you have no idea who is logging in or using their account, and the second is that when you find out you have a malicious user on your system it's normally to late.