cPanel 2FA Bypass Exposes Tens of Millions of Websites to Hack

Digital Defense, Inc., a leader in vulnerability and threat management solutions, announced that its Vulnerability Research Team (VRT) exposed a previously undisclosed vulnerability affecting the cPanel & WebHost Manager (WHM) web hosting platform.

cPanel & WHM is a suite of tools built for Linux OS that enables hosting providers and users the ability to automate server management and web hosting tasks. The software suite is currently used to manage above 70 million domains across the globe.

Many cPanel & WHM interfaces create URIs to other interfaces by incorporating user-supplied data in URI query parameters. These interfaces were using URL encoding on the parameters rather than URI encoding. Due to this fault, a cPanel & WHM user could be misled into performing actions they did not intend.

The cPanel &WHM version 11.90.0.5 (90.0 Build 5) exhibits a two-factor authentication bypass defect, susceptible to brute force attack.

 An attacker with knowledge of or access to valid credentials could evade two-factor authentication protections on an account. Digital Defense’s in-house testing demonstrated that an attack will be get done in minutes.

“The two-factor authentication cPanel Security Policy did not prevent an attacker from repeatedly submitting two-factor authentication codes. This allowed an attacker to bypass the two-factor authentication check using brute force techniques.” reads a security advisory released by the company. 

This problem was addressed with the release of the following builds:

  • 11.92.0.2
  • 11.90.0.17
  • 11.86.0.32

The Digital Defense, Vulnerability Research Team right away makes contact with the affected vendor to notify the organization of the new finding(s) and help out, wherever possible, with the vendor’s remediation actions.

“Our standard practice is to work in tandem with organizations on a coordinated disclosure effort to facilitate a prompt resolution to a vulnerability. We will continue outreach to customers ensuring they are aware and able to take action to mitigate any potential risk introduced by the vulnerability,” states Mike Cotton, senior vice president of engineering at Digital Defense.”

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Also Read

Ensiko – A PHP Based Web Shell with Ransomware Capabilities Attacks PHP Installation

Hackers using weaponized TeamViewer to Attack & Gain Full Control of the Government Networks

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

Attackers Exploit Microsoft Entra Billing Roles to Escalate Privileges in Organizational Environments

A startling discovery by BeyondTrust researchers has unveiled a critical vulnerability in Microsoft Entra ID…

19 hours ago

Threat Actors Exploit Google Apps Script to Host Phishing Sites

The Cofense Phishing Defense Center has uncovered a highly strategic phishing campaign that leverages Google…

20 hours ago

Dadsec Hacker Group Uses Tycoon2FA Infrastructure to Steal Office365 Credentials

Cybersecurity researchers from Trustwave’s Threat Intelligence Team have uncovered a large-scale phishing campaign orchestrated by…

21 hours ago

Beware: Weaponized AI Tool Installers Infect Devices with Ransomware

Cisco Talos has uncovered a series of malicious threats masquerading as legitimate AI tool installers,…

21 hours ago

Pure Crypter Uses Multiple Evasion Methods to Bypass Windows 11 24H2 Security Features

Pure Crypter, a well-known malware-as-a-service (MaaS) loader, has been recognized as a crucial tool for…

22 hours ago

Attackers Exploit Microsoft Entra Billing Roles to Escalate Privileges

A recent discovery by security researchers at BeyondTrust has revealed a critical, yet by-design, security…

22 hours ago