Imunify360 Vulnerability Could Expose Millions of Sites to Hacking

A serious vulnerability in Imunify360’s ImunifyAV+ malware scanner could allow arbitrary code execution by uploading a specially crafted file to shared hosting servers, potentially compromising the entire hosting environment. According to Patchstack, the flaw can be triggered when the scanner processes the malicious file, and attackers could sign up for shared hosting accounts to upload malware designed to exploit it, with code executed under the scanner’s elevated root privileges.

The vulnerability has been patched, but Cloud Linux Software has not assigned a CVE identifier for it, and an advisory published on 4 November noted the Ai-Bolit malware scanner is affected while a patch has been available since 21 October. Patchstack has disclosed technical details and a PoC exploit, and has urged hosting providers to check for signs of compromise.

Imunify360 is marketed for Linux-based web hosting environments, and the vendor stated in October data that it protected 56 million sites; the SecurityWeek report notes researchers warn of potential broad impact on sites sharing servers. According to Patchstack.