Name: 2FA bypass discovered in web hosting software cPanel | ZDNET
Brand: zdnet.com
SKU: zdnet-com-359
Availability: OnlineOnly

critic

2FA bypass discovered in web hosting software cPanel | ZDNET

preview

We and our partners use cookies to understand how you use our site, improve your experience and serve you personalized content and advertising. Read about how we use cookies and your choices . By continuing to use this site, you accept these cookies.AcceptRejectUpdate ConsentSecurity researchers have discovered a major security flaw in&nbsp;, a popular software suite used by web hosting companies to manage websites for their customers. The bug, discovered by security researchers from Digital Defense, allows attackers to bypass two-factor authentication (2FA) for cPanel accounts. Also:These accounts are used by website owners to access and manage their websites and underlying server settings. Access to these accounts is critical, as once compromised, they grant threat actors full control over a victim's site. On its website, cPanel boasts that its software is currently used by hundreds of web hosting companies to manage more than 70 million domains across the world. But in a&nbsp;&nbsp;today, Digital Defense says that the 2FA implementation on older cPanel &amp; WebHost Manager (WHM) software was vulnerable to brute-force attacks that allowed threat actors to guess URL parameters and bypass 2FA — if 2FA was enabled for an account.While brute-forcing attacks, in general, usually take hours or days to execute, in this particular case, the attack required only a few minutes, Digital Defense said today. Exploiting this bug also requires that attackers have valid credentials for a targeted account, but these can be obtained from phishing the website owner. While this might make some website owners think the bug is not important, it's actually the opposite since 2FA solutions were invented in the first place to protect against the use of phished credentials, and, as a result, any 2FA bypass like this bug needs to be treated with the utmost urgency and attention.The good news is that Digital Defense has privately reported the bug, tracked as&nbsp;, to the cPanel team, which has already released&nbsp;&nbsp;last week. Website owners who use 2FA on their cPanel login can see if their web hosting provider has rolled out the update to their cPanel installation by checking the platform's version number. Per cPanel's security advisory, the 2FA bypass issue has been patched in cPanel &amp; WHM software 11.92.0.2, 11.90.0.17, and 11.86.0.32.Users should not disable 2FA for their cPanel accounts because of this bug, but should instead request that their web hosting providers update the cPanel installation to the latest version. A cPanel spokesperson was not immediately available for comment.

We and our partners use cookies to understand how you use our site, improve your experience and serve you personalized content and advertising. Read about how we use cookies and your choices . By continuing to use this site, you accept these cookies.AcceptRejectUpdate ConsentSecurity researchers have discovered a major security flaw in&nbsp;, a popular software suite used by web hosting companies to manage websites for their customers. The bug, discovered by security researchers from Digital Defense, allows attackers to bypass two-factor authentication (2FA) for cPanel accounts. Also:These...

public

Contributor

Catalin Cimpanu is a security reporter at ZDNet, where he covers cyber-security, data breaches, hacking, and other related topics. He previously served as security reporter for Bleeping Computer and Softpedia.

https://www.zdnet.com/meet-the-team/us/catalin.cimpanu/

Catalin Cimpanu

ZDNet is a business technology news website published by CBS Interactive, along with TechRepublic. The brand was founded on April 1, 1991, as a general interest technology portal from Ziff Davis and evolved into an enterprise IT-focused online publication owned by CNET Networks.

zdnet.com

Credible

Speculation

Anecdotal Evidence

Generalization

Stacking the Deck

Appeal to Authority

Straw Man

Slippery Slope

Emotional Appeal

Red Herring

False Dilemma

Illogical

Moral Equivalency

Ad Hominem

Correlation w/o Causation

Semantics

Begging the Question

Faulty Analogy

Non Sequitur

Bandwagon

Dogmatism

Failing Occam's Razor

Biased

Pure Opinion

Hit Piece

Racial Bias

National Bias

Religious Bias

Financial Incentive

Political Agenda

Gender Bias

Misused Image/Video

Study Misinterpreted

Mistake

Misused Term

Science Misrepresented

Factual Error

Satire

Surface Level

Lack of Reliable Sources

Sensational

Not Credible

Investigative

Balanced

Well Sourced

Great Context

sports

entertainment

U.S.

international

business

technology

science

culture

politics

media

health

2FA bypass discovered in web hosting software cPanel | ZDNET

No article scores yet.

CRITIC REVIEWS

PUBLIC REVIEWS