cPanel/WHM Security updates

cPanel has released cPanel/WHM security updates recently to address few security issues. It is recommended that you upgrade your cPanel as soon as possible. If you have set to upgrade cPanel updates automatically, your cPanel should be upgraded automatically to the latest version.

They released the updates for their supported version. If you are using their EOL version, it is highly recommend that you upgrade your cPanel version to latest version. Following are the few security issues those were addressed in the cPanel/WHM security updates.

[1] cPanel – Activate Remote Name Servers Arbitrary Command Execution.

There is an arbitrary command execution within the activate_remote_nameservers.cgi feature when using the SoftLayer module and possibly also the VPS.NET module. The end result is that a reseller would be able to run any command as root which would ultimately lead to a privilege escalation. This exploit also includes an input validation failure.

[2] cPanel – cPAddons Moderation Stored XSS.

It is possible for a malicious user to create a stored XSS vulnerability within the cPAddons moderation files which could cause dangerous code to be rendered within the administrators web browser when using WHM.

[3] cPanel – Update Analysis Insecure File Permissions.

There is an option to send update logs to cPanel which is not enabled by default, but if the option is turned on then it is possible for a malicious user to obtain the contents which could include sensitive information in the various access and error logs.

[4] cPanel – Modifyacct ACL Failures.

It is possible for a reseller to enable and/or disable certain features for their sub accounts that should not be available to them as they are intended for admins only.

[5] cPanel – Log Directory Insecure File Permissions.

The cPanel logs directory /usr/local/cpanel/logs contained various log files, some of which were user readable. Some of those log files, under certain circumstances, could contain sensitive information.

[6] EasyApache 3.24.14 Released (Security Updates).

An update for EasyApache was released to address various security vulnerabilities and it is recommended that you update as soon as possible.

If you have still not applied cPanel/WHM security updates, you should upgrade your cPanel version as soon as possible.