WebPros Plesk Arbitrary Code Execution Vulnerability via Domain Creation

A vulnerability allowing remote authenticated users to execute arbitrary code as root has been identified in WebPros Plesk versions prior to 18.0.73.5 and 18.0.74 prior to 18.0.74.2 on Linux. This issue arises in the domain creation process, where users with 'Create and manage sites' permission, along with 'Domains management' and 'Subdomains management' access, can exploit the vulnerability.

Impact

Exploitation of this vulnerability allows for local privilege escalation, enabling a malicious Plesk user to execute code on behalf of root, thereby compromising the Plesk server.

Remediation

Users can update Plesk to the latest version to address this vulnerability. Instructions for installing Plesk updates are available in the Plesk support documentation.