CVE-2023-0829
📋 TL;DR
This is a cross-site scripting (XSS) vulnerability in Plesk control panel versions 17.0 through 18.0.31. A malicious subscription owner can inject scripts that execute with administrator privileges when an admin visits certain subscription-related pages, potentially leading to full server compromise. This affects Plesk administrators who manage servers with untrusted subscription owners.
💻 Affected Systems
- Plesk
📦 What is this software?
Plesk by Plesk
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise where an attacker gains complete administrative control over the Plesk server, potentially accessing all hosted websites, databases, and server configurations.
Likely Case
Session hijacking, credential theft, or privilege escalation leading to unauthorized administrative access to the Plesk control panel.
If Mitigated
Limited impact if administrators use separate accounts for daily operations, have strict access controls, and avoid visiting suspicious subscription pages.
🎯 Exploit Status
Exploitation requires authenticated subscription owner access and administrator interaction with the malicious page.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 18.0.32 and later
Vendor Advisory: https://www.plesk.com/blog/product-technology/security-update-plesk-onyx-18-0-32/
Restart Required: No
Instructions:
1. Log into Plesk as administrator. 2. Navigate to Tools & Settings > Updates and Upgrades. 3. Click 'Check for Updates'. 4. Install available updates to version 18.0.32 or later.
🔧 Temporary Workarounds
Restrict subscription owner privileges
allLimit subscription owners' ability to modify content that could contain XSS payloads.
Admin browsing restrictions
allImplement policies preventing administrators from browsing untrusted subscription pages.
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) headers to prevent script execution
- Use browser extensions that block XSS attacks for administrative sessions
🔍 How to Verify
Check if Vulnerable:
Check Plesk version via command line: plesk version or via Plesk admin panel > Help > About.Check Version:
plesk versionVerify Fix Applied:
Confirm version is 18.0.32 or later using same commands.📡 Detection & Monitoring
Log Indicators:
- Unusual subscription modifications followed by administrator page visits
- Suspicious JavaScript in subscription-related logs
Network Indicators:
- Unexpected outbound connections from Plesk server following admin page visits
SIEM Query:
source="plesk.log" AND ("subscription" OR "customer") AND ("script" OR "javascript" OR "<script>")