CVE-2017-18443 : Security Advisory and Response

In versions of cPanel prior to 64.0.21, a vulnerability (SEC-247) allows demo and suspended accounts to utilize SSH port forwarding.

Understanding CVE-2017-18443

This CVE relates to a security issue in cPanel versions before 64.0.21 that permits unauthorized usage of SSH port forwarding by demo and suspended accounts.

What is CVE-2017-18443?

cPanel versions earlier than 64.0.21 have a vulnerability (SEC-247) that enables demo and suspended accounts to exploit SSH port forwarding.

The Impact of CVE-2017-18443

The vulnerability allows unauthorized users to utilize SSH port forwarding, potentially leading to unauthorized access and misuse of resources.

Technical Details of CVE-2017-18443

Vulnerability Description

Vulnerability Type: Insecure SSH Port Forwarding
CVE ID: CVE-2017-18443
Security Issue: SEC-247

Affected Systems and Versions

Systems: cPanel versions before 64.0.21
Accounts: Demo and suspended accounts
Impact: Unauthorized SSH port forwarding

Exploitation Mechanism

Unauthorized users can exploit the vulnerability to access SSH port forwarding capabilities.

Mitigation and Prevention

Immediate Steps to Take

Upgrade cPanel to version 64.0.21 or later to mitigate the vulnerability.
Monitor SSH activity for any unauthorized port forwarding.

Long-Term Security Practices

Regularly review and update access controls for SSH services.
Educate users on secure SSH practices and the risks of unauthorized port forwarding.

Patching and Updates

Apply patches and updates provided by cPanel to address the vulnerability.