What it is
The backup plugin leaves files with permissions that are too loose. Anyone with a low-level account on the server can use that to make themselves the server’s administrator, and from there reach every website and mailbox on it. Acronis scores it 7.8 because the attacker needs some account on the server first.
On shared hosting, that bar is low. Other customers have accounts on the same machine, and so does anyone who has broken into one of their websites. CISA has listed it as exploited, so this isn’t theoretical.
Three questions for your host
- Does our server run Acronis Backup?The cPanel & WHM plugin, the Plesk extension or the DirectAdmin plugin.
- Is it updated, and when?cPanel & WHM build 1021 or later (1.9.3 HF3 or 1.9.4), Plesk build 638 or later, DirectAdmin build 238 or later, and the date it was installed.
- Did you check the server for signs of misuse?It was exploited, so a careful host checks for new accounts and changed files, not just installs the update.
If your host can’t say which backup software runs on your server, that’s an answer in itself. The sites we build don’t run on a shared cPanel or Plesk server at all. If you’d like yours moved off one, tell us about it.
Sources
Written by Nikita Huttenlocher, founder and lead engineer at Huttenlocher Technologies, a cybersecurity and software firm in Myrtle Beach, South Carolina. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.