Security Alert: cPanel doesn't require username to log in...

Heya folks,

I posted this here because I figure a lot of you use cPanel at your own websites. I do myself, so hopefully this is useful information to some of you.

I got an email yesterday on bugtraq claiming that to log into a cPanel account you do not need a username, only the password. I tried this out on mine, and it seems to be true. I left the username field blank, and only typed my password, and it logged me in just fine.

I'm not sure that there is an updated version of cPanel out yet to use, but you all should be aware of this, as it makes the breaking in significantly easier for an intruder, especially if (like me) you use a not-so-easily-guessed username.

Thanks for the heads up - I just tried it on mine, and it indeed works :/

thanks Jehnx, a good post. Makes a good case for changing to a more complicated password that might not be so easily sniffed. :-)

Quote:

---

Originally posted here by The Old Man
thanks Jehnx, a good post. Makes a good case for changing to a more complicated password that might not be so easily sniffed. :-)

---

A sniffed password is a sniffed password... it doesn't matter how complicated it is... if it's sniffed.. they have it.. period...

This is a great reason why cpanel should operating over HTTPS though instead of HTTP... that will prevent it from being easily sniffed... as it would require a MITM attack.

I've noticed fishy behaviour in the past with cpanel.. I had a reseller account (let's say it was www.reselleraccount.com) and I had client accounts www.clientaccount.com and www.client2account.com)..

cpanel was accessible on each through domain/cpanel...

I could go to any of the pages though and log into any of the other cpanel accounts... On occasion I'd give the proper username for one of the domains and the password for another domain (too many passwords = confusion)... and I'd log into the other domain.. So I'd go to www.reselleraccount.com and I enter reseller_username and client2_password and end up in the client2 site..

Now remember that this is version specific... there've been responses to the Bugtraq post with versions that it doesn't work with and I just tested against 10.8.2-RELEASE 119 and it didn't work, same goes for 10.8.2-EDGE 6. Anyone wishing to see this... You can google "cpanel demo" and find tons of sites with demo accounts.

Peace,
HT

mmmm......looks like the developers never looked upon it!!??? Anyway I am amazed!! Once I had to get a new installation of Cpanel jus coz I forgot the username....I had it a looooong and complicated one!! I wish I had this news then!!! POOR ME?? :(