cPanel TSR-2023-0001 Full Disclosure<\/p>\n
SEC-673<\/strong><\/p>\n Summary<\/strong><\/p>\n XSS vulnerability on \u2018Repair a MySQL Database\u2019 page in WHM<\/p>\n Security Rating<\/strong><\/p>\n cPanel has assigned this vulnerability a CVSSv3.1 score of Severity: 6.1 CVSS:3.1\/AV:L\/AC:L\/PR:L\/UI:R\/S:U\/C:H\/I:L\/A:L Description<\/p>\n It was possible for a cPanel user to create a database with javascript in the name. Then, the javascript would be fetched and executed when the server admin loaded the \u2018Repair a MySQL Database\u2019 page via WHM.<\/p>\n Credits<\/strong><\/p>\n This issue was discovered by Aliz Hammond of watchTowr.com.<\/p>\n Solution<\/strong><\/p>\n This issue is resolved in the following builds:<\/p>\n 11.112.0.1 SEC-672<\/strong><\/p>\n Summary<\/strong><\/p>\n Authenticated RCE for webmail virtual accounts<\/p>\n Security Rating<\/strong><\/p>\n cPanel has assigned this vulnerability a CVSSv3.1 score of 5.3 CVSS:3.1\/AV:L\/AC:L\/PR:L\/UI:N\/S:U\/C:L\/I:L\/A:L<\/p>\n Description<\/strong><\/p>\n It is possible to craft a string that gets past the regex check performed via the deprecated Email::addforward API1 call. Subsequent calls to api1\/api2\/uapi calls to remove forwarders will remove the escape () characters in the string. This can turn the forwarder added with the string into a valid forwarder that allows for an RCE to the user\u2019s cPanel account.<\/p>\n Credits<\/strong><\/p>\n This issue was discovered by John Lightsey.<\/p>\n Solution<\/strong><\/p>\n This issue is resolved in the following builds:<\/p>\n 11.112.0.1 SEC-670<\/strong><\/p>\n Summary<\/strong><\/p>\n HTTP request smuggling vulnerability in cpsrvd<\/p>\n Security Rating<\/strong><\/p>\n cPanel has assigned this vulnerability a CVSSv3.1 score of 3.7 CVSS:3.1\/AV:N\/AC:H\/PR:N\/UI:N\/S:U\/C:L\/I:N\/A:N.<\/p>\n Description<\/strong><\/p>\n \u2018cpanel::cpsrvd::read_socket_headers\u2019 is susceptible to a race condition on keep-alive requests from unprotected documents where the original request headers contain a \u2018Content-Length\u2019 header. This can occur when the original request contains a smuggled request that causes the readline to hang while reading the socket due to waiting on the condition provided by $\/ to be met. If a second keep-alive request comes in during this time, the entire keep-alive request can be appended to the smuggled request as part of its headers, thus causing the smuggled request to be processed when it should not have been.<\/p>\n
\n11.110.0.6
\n11.108.0.16
\n11.102.0.33<\/p>\n
\n11.110.0.6
\n11.108.0.16
\n11.102.0.33<\/p>\n