Hostinger has published a report on unauthorized access to one of its shared hosting servers in Phoenix, in the United States. An attacker exploited a previously unknown flaw in LiteSpeed Web Server, the software Hostinger uses to serve websites, to break out of the isolation between customer accounts and eventually gained root access. On that server, the attacker ran code or read credentials on about 400 accounts.
According to the report, Hostinger has mitigated the issue on its shared hosting servers and is working directly with LiteSpeed on a permanent fix. The report, by chief product officer Saulius Lazaravičius, appeared on Hostinger’s blog on November 9, the day the company declared the incident.
Key facts
- One server: the affected machine is one of more than 5,000 servers Hostinger operates. It is now offline and held for investigation.
- Timeline: the attacker got onto the server on November 5, monitoring flagged the activity on November 8 and Hostinger declared the incident on November 9.
- Credentials: the credentials the attacker read included database credentials and access tokens.
- Backups: Hostinger found no evidence that its backup system was compromised or that any backups were decrypted.
From One Customer Website to Root Access
According to Hostinger, the attack began on November 5, when the attacker entered the server through a vulnerable content management system on a customer website. It took the attacker three days to find and exploit a new vulnerability in LiteSpeed Web Server. The flaw allowed code from one website to bypass the isolation between accounts provided by CloudLinux CageFS and eventually led to root-level access on the server.
Because the attacker’s code ran as the shared web server user, the activity blended in with normal server traffic. Hostinger’s security monitoring tool flagged suspicious activity on November 8.
LiteSpeed and CageFS on Shared Hosting Servers
CageFS is a virtualized file system that places each hosting user in a separate “cage.” According to CloudLinux’s documentation, users inside a cage cannot see other users or their processes, and CageFS isolates scripts run through LiteSpeed Web Server, Apache, cron jobs and SSH, among others. LiteSpeed lists CageFS support among the CloudLinux integration features of its web server. It describes the server as a drop-in replacement for Apache that works with control panels such as cPanel, Plesk and DirectAdmin.
In September, Hostinger reported an attack on a server in its Brazil data center that exploited another zero-day in LiteSpeed Web Server. That flaw also let a low-privileged shared hosting user bypass isolation boundaries such as those provided by CageFS, and it gave the attacker root-level access to one server. Hostinger worked with LiteSpeed on a fix and deployed the patched version, 6.3.7 Build 2, across its shared hosting fleet on September 16, the day of the attack.
Accounts Moved and Websites Restored From Backups
Hostinger declared the incident at 12:26 UTC on November 9. It removed the attacker’s access, rotated internal credentials and preserved evidence for forensic analysis. From 13:30 UTC, it moved every account and website on the server to other servers and restored affected websites from backups taken before the attack.
The company emailed affected customers individually and notified the competent authority. Hostinger found no evidence that the attacker compromised its internal management systems or the systems that handle logins to Hostinger accounts.
The configuration changes Hostinger made during its response stay in place as an extra layer of protection. The investigation is ongoing, and Hostinger plans to update the report with any new findings.
