CVE-2024-39182

ISPmanager leaks details of the root user's session to an attacker who can run a particular command against it, an information disclosure that reaches without authentication. Session information is sensitive because it's the kind of thing that enables impersonation: exposing details of a root session on a hosting control panel edges toward hijacking the most powerful account on the box.

Hosting control panels are high-value targets — they sit in front of many sites and hold the keys to the underlying server — so an unauthenticated leak touching the root session is more consequential than a generic disclosure. It's still a read primitive rather than direct takeover, but on this kind of platform the gap between leaking session data and using it can be small.

Our angle is exposure plus watchful detection. Control panels like ISPmanager are internet-facing by function, so we confirm which instances answer publicly and treat any that do as priority given what a root-session leak enables. Where immediate patching isn't possible, monitoring for the specific command pattern at the proxy and rotating sessions are reasonable interim moves, because here the disclosure aims squarely at the account we can least afford to lose.