cPanel - Critical Security Vulnerability

[rohatcengizhanbucak]

A critical security vulnerability has been identified in cPanel that may allow attackers to gain unauthorized access to the control panel by affecting the authentication process. Due to this serious vulnerability, some hosting providers have temporarily blocked access to TCP ports 2083 and 2087.


Security updates have been released for the following versions / the issue has been resolved in these versions:


11.110.0.97
11.118.0.63
11.126.0.54
11.132.0.29
11.136.0.5
11.134.0.20


If your license is original or your license provider supports upgrades to the latest versions, be sure to run the following command:


/scripts/upcp --force


Note: You are responsible for any issues that may arise from the upgrade command. It is recommended that you seek support from your system administrator or license provider.

---

Q: Which version should cPanel be upgraded to?
A: Any of the versions listed above that is closest to your current version, or the latest version, currently 11.136.0.5.


Q: How can I check the current cPanel version via SSH?
A: Use the following command:
cat /usr/local/cpanel/version


Q: Which command should I use to upgrade the version?
A:
/scripts/upcp --force

 

[rohatcengizhanbucak]

 

[JordanH]

Yea, and as of today it seems one of my servers is compromised.
I updated cpanel, changed all passwords of all accounts, root password, databases, emails, etc.

I was right in the middle of getting a new server going too, so what a time for this to happen.

Was some dumps made of the home directories, so going to have to email users letting them know the database was also probably accessed too, and to change their passwords.

Even accounts that I had suspended had files placed in them. Yikes.

 

[Tamer]

Sorry to hear that. I hope the damage is limited and you can recover without too much trouble. Patching is only the first step. It closes the vulnerability going forward. It doesn’t prove the server wasn’t accessed before the fix was applied.

That’s why I’d separate patched from confirmed clean. After updating, it’s still worth checking access logs, session files and relevant IOCs before assuming the server was unaffected. Ransomware actors don’t always break things immediately.

 

[JordanH]

Sorry to hear that. I hope the damage is limited and you can recover without too much trouble. Patching is only the first step. It closes the vulnerability going forward. It doesn’t prove the server wasn’t accessed before the fix was applied.

That’s why I’d separate patched from confirmed clean. After updating, it’s still worth checking access logs, session files and relevant IOCs before assuming the server was unaffected. Ransomware actors don’t always break things immediately.

Oh 100%. Already on it.

Like I said, I was already on the move to a new server anyways, so that server is being left behind, and a fresh xenforo install is being put in place with just a database transfer, and then scanning the user uploads and attachments folders.

Just added extra work now is all.

 

[Tamer]

The one thing I’d try to pin down as much as possible is the timeline. Once you know when the first suspicious activity happened, you can make much better calls on trusted backups, exposed data, password resets and user notices.