Critical cPanel Authentication Vulnerability: Patch Now
cPanel and its WebHost Manager (WHM) product line contain a critical authentication flaw that could allow a remote attacker to bypass login controls and gain full control of the hosting panel. The vulnerability, tracked as CVE-2023-XXXXX, resides in the session-token generation routine used by the cPanel & WHM login handler (login endpoint at /login). By sending a specially crafted HTTP request with a malformed cookie, an adversary can trigger an authentication bypass, circumventing password verification and two-factor authentication mechanisms. The flaw affects all cPanel versions up to and including 11.102.0.1 and WHM versions up to 11.102.0.2.
Upon successful exploitation, the attacker obtains an authenticated session with the same privileges as the compromised user. This can range from a standard cPanel user able to manage files, databases, and email accounts, to a root-level WHM administrator who can modify server settings, install malicious PHP modules, or pivot to other systems on the network. In laboratory tests conducted by the researcher who disclosed the bug, a single HTTP request was sufficient to inject a rogue session cookie, highlighting the ease and speed of a potential attack.
cPanel released an emergency patch in version 11.102.0.2 (cPanel) and 11.102.0.3 (WHM) that addresses the authentication bypass. System administrators should update immediately via the built-in update utility (yum update cpanel) or by applying the binary patches provided in the cPanel download portal. As a precautionary measure, it is advisable to disable the "Allow Password Authentication" option for remote API calls, enforce two-factor authentication for all accounts, and review authentication logs for any abnormal login patterns.
The vulnerability has been flagged as a zero-day, as proof-of-concept code circulated on underground forums shortly after the advisory went live. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2023-XXXXX to its Known Exploited Vulnerabilities catalog, urging federal agencies to remediate within the prescribed timeframe. Organizations running cPanel-based hosting environments are strongly encouraged to apply the patches without delay, monitor for indicators of compromise, and consider temporary network segmentation of the control panel if immediate patching is not feasible.