CVE-2023-29489

What it actually does

CVE-2023-29489 is a reflected cross-site scripting flaw in cPanel's cpsrvd error handling for invalid webcall IDs. A remote unauthenticated attacker can craft a malicious cPanel URL containing script content in the webcall ID; when a user opens the URL, cpsrvd reflects the attacker-controlled input into an error page without sufficient sanitization. Because the vulnerability is triggered over the network with low complexity but requires user interaction, successful exploitation can execute JavaScript in the victim's browser in the security context of the cPanel interface, enabling theft of session-adjacent data, unauthorized actions as the victim, phishing overlays, or redirection to attacker-controlled infrastructure.

Why it matters to the business

If exploited against an administrator, reseller, or hosting user, this flaw can help an attacker take over hosting control-panel sessions, alter website or email settings, create persistence through account changes, or pivot toward hosted applications. The risk is elevated because public exploitation is weaponized and the EPSS score is high, meaning internet-facing cPanel deployments are more likely to be targeted even though this is not currently listed in CISA KEV and is not known to be ransomware-specific. Organizations operating shared hosting, managed hosting, or business-critical websites should treat exposed unpatched cPanel servers as a priority because compromise of the control panel can lead to website defacement, mail abuse, data exposure, and service disruption.

How an attack unfolds

An attacker identifies an internet-facing cPanel or WHM service running a vulnerable version prior to the fixed builds. They craft a URL targeting the cpsrvd webcall handling path with an intentionally invalid webcall ID that contains encoded JavaScript or HTML event-handler payloads. The attacker then delivers the link to a cPanel user through phishing, support-ticket messages, chat, email, embedded website content, or another social-engineering path. When the victim opens the link while authenticated, cpsrvd generates an error page for the invalid webcall ID and reflects the malicious value into the response. The victim's browser executes the payload in the cPanel origin, allowing the attacker to steal page data accessible to JavaScript, perform actions through the victim's active session, display credential-harvesting UI, or redirect the victim to additional exploit infrastructure. Follow-on impact depends on the victim's privileges inside cPanel or WHM.

How to fix it

Upgrade cPanel to a fixed version or later. The vendor-fixed builds are 11.109.9999.116, 11.108.0.13, 11.106.0.18, and 11.102.0.31; any release prior to the applicable fixed build should be considered vulnerable. Where immediate patching is not possible, reduce exposure by restricting access to cPanel, WHM, and webmail ports to trusted IP ranges or VPN, enforcing MFA for privileged accounts, disabling unnecessary externally reachable management interfaces, and using a reverse proxy or WAF rule to block suspicious requests to cpsrvd webcall paths containing encoded script characters. Mitigations should be considered temporary; patching is the durable fix.

How to confirm the fix worked

Confirm the installed cPanel build is at or above the applicable fixed version using the cPanel update interface or command-line version checks, and verify that automatic updates are enabled where operationally appropriate. From an external network perspective, inventory exposed cPanel-related ports and confirm only intended management interfaces are reachable. To validate remediation safely, request a benign invalid webcall URL containing encoded HTML metacharacters and confirm the response escapes or rejects the payload rather than reflecting executable markup. Review HTTP response bodies for proper encoding and confirm no script execution occurs in a test browser. Also verify compensating controls such as IP allowlisting, MFA enforcement, and WAF signatures remain in place after the upgrade.

Typical attack path

1. Scan for exposed cPanel, WHM, webmail, or cpsrvd services on common ports such as 2082, 2083, 2086, 2087, 2095, and 2096.
2. Fingerprint the cPanel version or infer vulnerability from response behavior and patch level.
3. Create a malicious URL containing an invalid webcall ID with URL-encoded script, HTML, or event-handler content.
4. Deliver the URL to a cPanel, reseller, or WHM administrator through phishing, support messages, or embedded links.
5. Victim opens the link, causing cpsrvd to render an error page that reflects the malicious webcall ID.
6. JavaScript executes in the victim's browser under the cPanel origin.
7. Attacker uses the victim's session context to harvest information, perform control-panel actions, redirect the user, or stage additional compromise.

How to detect it

Investigate whether exposed cPanel services received suspicious cpsrvd webcall requests before patching. Relevant log sources include cPanel access logs, cpsrvd logs, web server reverse-proxy logs, WAF logs, authentication logs, and endpoint telemetry for administrative workstations that accessed cPanel. Focus on requests to cPanel webcall or invalid webcall error paths containing URL-encoded HTML metacharacters, script tags, JavaScript schemes, SVG payloads, iframe tags, or event-handler attributes such as onerror and onload. Correlate suspicious requests with authenticated cPanel or WHM sessions from administrators or resellers, then review subsequent control-panel actions for unauthorized changes. Useful post-exploitation artifacts include unexpected cPanel/WHM account changes, new FTP or email accounts, password resets, added email forwarders, modified DNS records, new cron jobs, file-manager uploads, altered web-root files, redirects, unfamiliar API tokens, and administrative logins from unusual IP addresses. Because XSS payloads are often customized, detections should combine vulnerable path patterns with generic HTML/JavaScript injection markers rather than depend on a single fixed payload.

• /cpanelwebcall/
• Invalid webcall ID
• %3Cscript
• %3C%2Fscript%3E
• <script
• </script>
• javascript:
• %6a%61%76%61%73%63%72%69%70%74%3a
• onerror=
• onload=
• %20onerror%3D
• %20onload%3D
• %3Csvg
• %3Ciframe
• document.cookie
• document.location
• window.location
• eval(
• alert(
• cpsrvd

What your security team should do

• Prioritize upgrading all internet-facing cPanel systems to 11.109.9999.116, 11.108.0.13, 11.106.0.18, 11.102.0.31, or later because exploit code is weaponized and EPSS is high.
• Inventory externally reachable cPanel, WHM, and webmail services, especially on ports 2082, 2083, 2086, 2087, 2095, and 2096.
• Restrict administrative interfaces to trusted networks or VPN and enforce MFA for all administrator, reseller, and hosting-user accounts.
• Search access logs for requests to webcall paths containing encoded script tags, event handlers, JavaScript URLs, or other HTML injection markers.
• Review recent privileged account activity after suspicious requests, including account creation, password changes, email forwarders, DNS changes, file-manager activity, cron jobs, and web-root modifications.
• Add SIEM detections for cpsrvd requests containing /cpanelwebcall/ together with encoded angle brackets, script tags, or common XSS event handlers.
• Educate support and operations teams not to open unsolicited cPanel links from tickets, chat, or email without validating the destination.