cPanel – Arbitrary File Access (R911-0055)

Type: Arbitrary File Access
Location: Local
Impact: High
Product: cPanel
Vulnerable Version: All versions prior to the fixed builds below.
Fixed Version:,,, &
CVE: -
R911: 0055
Date: 2013-08-29
By: Rack911

Product Description:

cPanel is an easy-to-use control panel that gives web hosts and the website owners they serve, the ability to quickly and easily manage their servers and websites. Web Host Manager (WHM) is a part of the cPanel software, often used by resellers and system administrators.

Vulnerability Description:

There is a flaw within the Rearrange an Account feature that can be made available to resellers that would ultimately allow an attacker to read any file on the server regardless of ownership. There are several files on a cPanel server that will disclose the root password in plain-text making this a root level exploit.

Proof of Concept:

Due to the nature of this security flaw, we will not be posting a Proof of Concept until a much later date.


We have deemed this vulnerability to be rated as HIGH due to the fact that any file can be viewed regardless of ownership.

Vulnerable Version:

This vulnerability was tested against cPanel and is believed to exist in all versions prior to the fixed builds below.

Fixed Version:

This vulnerability was patched in cPanel,,, &

Vendor Contact Timeline:

2013-07-20: Vendor contacted via email.
2013-08-01: Vendor confirms vulnerability.
2013-08-27: Vendor issues updates to all builds.
2013-08-29: Rack911 issues security advisory.