Speaking of security gaps, 2021 has been a notable year for software weaknesses, with several public exploits circulating in the wild. Regarding this, the very popular software control panel and web-hosting solutions company cPanel alerted users of multiple software vulnerabilities. The vulnerabilities are related to cPanel’s EasyApache-4 product. There were 3 vulnerabilities reported, one of which was classified as high-risk.
About cPanel, L.L.C
cPanel, L.L.C, established in 1996, is an American corporation that offers web hosting control panels and the respective management software for these products. cPanel is a shortened form of ‘control panel’, an interface that allows for customization and modifications to hosting accounts with InMotion Hosting. The company provides graphical interface-based solutions, as well as automation solutions that increase the efficiency of website hosting, as well as simplifying this process. According to the official cPanel website, the company “Create an exceptional hosting experience”, and offer an “Industry-leading hosting platform with world-class support.” cPanel works with partners such as CloudLinux, Litespeed, Sectigo, WordPress, and WHMCS. The products offer a rich set of features that boost business with transfer tools, add-ons, backup, and recovery, as well as being famous in the industry for its specific graphical interface.
What is EasyApache-4?
The Software Vulnerability
On September 1st, 2021 a vulnerability release report was made public on the Newsroom section of the official cPanel website. The vulnerability report revealed several vulnerabilities, of which one was classified as high-risk (the others are medium.) The high-risk vulnerability in an unpatched system may lead to remote attacker access as well as complete system compromise.
Technical Details
The technical details surrounding the high-severity vulnerability are as follows; The vulnerability exists due to a boundary error in EVP_PKEY_decrypt() function within the implementation of the SM2 decryption. A remote attacker can send specially crafted SM2 content for decryption to trigger a buffer overflow by 62 bytes and execute arbitrary code on the target system. The CVE ID database code for this vulnerability is CVE-2021-3711.
Vulnerable Software Versions
The EasyApache-4 software versions that are vulnerable to the above issues span all of the items noted in the following list;
Important User Information
Users of cPanel’s EasyApache-4 will find it useful to know that this software vulnerability issue has been addressed. It is advisable to read through this update information. In this update information, the following information is critical, “cPanel, L.L.C. has released updated RPMs for EasyApache 4 on September 1, 2021, with OpenSSL version 1.1.1l and a patch for APR version 1.7.0. Unless you have enabled automatic RPM updates in your cron, update your system with either yum update or WHM’s Run System Update interface.”
