Security Advisory: WHMCS Admin Password Reset Weak Token
A weak token generation flaw in WHMCS's admin password reset flow is fixed in this security release: predictable reset tokens put administrator accounts at takeover risk. Update WHMCS from the Admin Area and rotate admin credentials as a precaution.
Затронутые версии
WHMCS 8.9.0 and earlier
Исправленная версия
WHMCS 8.10.1
Команда обновления по умолчанию
yum update -yКоманды исправления
All Systems
Back up /var/www/html/whmcs
Download the patched release
Run the upgrade wizard at /install/upgradeЧто это значит по лицензии SharedLicense
Your SharedLicense license itself is not affected — this is a change in WHMCS software, not in licensing. Apply it on every affected server: update to the fixed release from the WHMCS Admin Area. Licenses keep working through updates; nothing needs re-issuing or re-activating.
What happened
Password reset flows are only as strong as the secrecy of their tokens. WHMCS‘s admin reset tokens were generated too predictably, so an attacker who could request a reset and predict the token could set a new administrator password — full control of the billing and provisioning platform.
Who is affected
WHMCS installations — which concentrate customer records, invoices and hosting account credentials in one internet-exposed system. Admin compromise there is about the worst single event a hosting business can have.
How to apply the fix
- Update WHMCS to the fixed release from the Admin Area.
- Rotate administrator passwords after updating.
- Review admin accounts and recent password-reset requests in the logs.
For SharedLicense customers
Licensing is unaffected — this is WHMCS software. Given what a WHMCS holds, treat this update as priority even though the flaw is now patched.
Часто задаваемые вопросы
What was wrong with the reset tokens?
What should I do besides updating?
How is WHMCS updated?
Источники
Предупреждения о безопасности
Похожие предупреждения
Проверьте систему на уязвимости
Выберите продукт и операционную систему, чтобы увидеть точные команды исправления.
Проверьте свою систему