Archive for May, 2014

cPanel – Security Tokens Evasion w/ Multiple Stored XSS (R911-0160)

Monday, May 26th, 2014

Type: Security Tokens Evasion
Location: Remote
Impact: High
Product: cPanel
Website: http://www.cpanel.net
Vulnerable Version: All versions prior to the fixed builds below.
Fixed Version: 11.43.0.12, 11.42.1.16 & 11.40.1.14
CVE: -
R911: 0160
Date: 2014-05-26
By: Rack911

Product Description

cPanel is an easy-to-use control panel that gives web hosts and the website owners they serve, the ability to quickly and easily manage their servers and websites. Web Host Manager (WHM) is a part of the cPanel software, often used by resellers and system administrators.

Vulnerability Description

It is possible for a malicious user to evade the default security token settings by performing a stored XSS attack in various functions along with a redirect to a secondary website to capture the referrer, and then redirect a second time back to the originating cPanel server to perform malicious commands.

Impact

We have deemed this vulnerability to be rated as HIGH due to the fact that malicious commands could be performed by the root user.

Vulnerable Version

This vulnerability was tested against cPanel prior to the fixed versions below.

Fixed Version

This vulnerability was patched in cPanel 11.43.0.12, 11.42.1.16 & 11.40.1.14.

Vendor Contact Timeline

2014-02-15: Vendor contacted via email.
2014-02-15: Vendor confirms vulnerability.
2014-05-19: Vendor issues updates to all builds.
2014-05-26: Rack911 issues security advisory.

cPanel – DNS Cluster Trust Relationship Stored XSS (R911-0159)

Monday, May 26th, 2014

Type: XSS
Location: Local
Impact: Medium
Product: cPanel
Website: http://www.cpanel.net
Vulnerable Version: All versions prior to the fixed builds below.
Fixed Version: 11.43.0.12, 11.42.1.16 & 11.40.1.14
CVE: -
R911: 0159
Date: 2014-05-26
By: Rack911

Product Description:

cPanel is an easy-to-use control panel that gives web hosts and the website owners they serve, the ability to quickly and easily manage their servers and websites. Web Host Manager (WHM) is a part of the cPanel software, often used by resellers and system administrators.

Vulnerability Description:

Should any malicious HTML find it’s way into the hostname being used by a server configured within a cluster, it could then potentially render an XSS attack within the administrator’s web browser when viewing the trustclustermaster.cgi feature.

Impact:

We have deemed this vulnerability to be rated as MEDIUM due to the fact that malicious HTML can be rendered in an administrators web browser.

Vulnerable Version:

This vulnerability was tested against cPanel prior to the fixed versions below.

Fixed Version:

This vulnerability was patched in cPanel 11.43.0.12, 11.42.1.16 & 11.40.1.14.

Vendor Contact Timeline:

2014-04-06: Vendor contacted via email.
2014-04-08: Vendor confirms vulnerability.
2014-05-19: Vendor issues updates to all builds.
2014-05-26: Rack911 issues security advisory.

cPanel – Statmanager.cgi Self-Stored CSRF & XSS (R911-0158)

Monday, May 26th, 2014

Type: CSRF & XSS
Location: Local
Impact: Medium
Product: cPanel
Website: http://www.cpanel.net
Vulnerable Version: All versions prior to the fixed builds below.
Fixed Version: 11.43.0.12, 11.42.1.16 & 11.40.1.14
CVE: -
R911: 0158
Date: 2014-05-26
By: Rack911

Product Description:

cPanel is an easy-to-use control panel that gives web hosts and the website owners they serve, the ability to quickly and easily manage their servers and websites. Web Host Manager (WHM) is a part of the cPanel software, often used by resellers and system administrators.

Vulnerability Description:

In the event that the administrator has turned off the default session tokens, it is possible for a malicious user to perform a CSRF attack along with an XSS attack that will end up being stored which could be used to further escalate their privileges.

Impact:

We have deemed this vulnerability to be rated as MEDIUM due to the fact that malicious HTML can be rendered in an administrators web browser.

Vulnerable Version:

This vulnerability was tested against cPanel prior to the fixed versions below.

Fixed Version:

This vulnerability was patched in cPanel 11.43.0.12, 11.42.1.16 & 11.40.1.14.

Vendor Contact Timeline:

2014-04-03: Vendor contacted via email.
2014-04-03: Vendor confirms vulnerability.
2014-05-19: Vendor issues updates to all builds.
2014-05-26: Rack911 issues security advisory.

cPanel – Showacctcopylog Stored XSS (R911-0157)

Monday, May 26th, 2014

Type: XSS
Location: Local
Impact: Medium
Product: cPanel
Website: http://www.cpanel.net
Vulnerable Version: All versions prior to the fixed builds below.
Fixed Version: 11.43.0.12, 11.42.1.16 & 11.40.1.14
CVE: -
R911: 0157
Date: 2014-05-26
By: Rack911

Product Description:

cPanel is an easy-to-use control panel that gives web hosts and the website owners they serve, the ability to quickly and easily manage their servers and websites. Web Host Manager (WHM) is a part of the cPanel software, often used by resellers and system administrators.

Vulnerability Description:

Should any malicious HTML find it’s way into a log file located under /var/cpanel/logs/ which could then be opened by root using the showacctcopylog function, it could then potentially render an XSS attack within their web browser.

Impact:

We have deemed this vulnerability to be rated as MEDIUM due to the fact that malicious HTML can be rendered in an administrators web browser.

Vulnerable Version:

This vulnerability was tested against cPanel prior to the fixed versions below.

Fixed Version:

This vulnerability was patched in cPanel 11.43.0.12, 11.42.1.16 & 11.40.1.14.

Vendor Contact Timeline:

2014-04-04: Vendor contacted via email.
2014-04-08: Vendor confirms vulnerability.
2014-05-19: Vendor issues updates to all builds.
2014-05-26: Rack911 issues security advisory.

cPanel – FTP Session Control Stored XSS (R911-0156)

Monday, May 26th, 2014

Type: XSS
Location: Remote
Impact: Medium
Product: cPanel
Website: http://www.cpanel.net
Vulnerable Version: All versions prior to the fixed builds below.
Fixed Version: 11.43.0.12, 11.42.1.16 & 11.40.1.14
CVE: -
R911: 0156
Date: 2014-05-26
By: Rack911

Product Description:

cPanel is an easy-to-use control panel that gives web hosts and the website owners they serve, the ability to quickly and easily manage their servers and websites. Web Host Manager (WHM) is a part of the cPanel software, often used by resellers and system administrators.

Vulnerability Description:

It is possible for a malicious user to create an XSS by spoofing various FTPD processes containing an XSS string. Should the root user log into the cPanel account and access the FTP Session Control, then the XSS attack will be performed against them.

Impact:

We have deemed this vulnerability to be rated as MEDIUM due to the fact that malicious HTML can be rendered against the root user under certain circumstances.

Vulnerable Version:

This vulnerability was tested against cPanel prior to the fixed versions below.

Fixed Version:

This vulnerability was patched in cPanel 11.43.0.12, 11.42.1.16 & 11.40.1.14.

Vendor Contact Timeline:

2014-04-03: Vendor contacted via email.
2014-04-07: Vendor confirms vulnerability.
2014-05-19: Vendor issues updates to all builds.
2014-05-26: Rack911 issues security advisory.

cPanel – Mailman Insecure Password Changing (R911-0155)

Monday, May 26th, 2014

Type: Content Disclosure
Location: Local
Impact: High
Product: cPanel
Website: http://www.cpanel.net
Vulnerable Version: All versions prior to the fixed builds below.
Fixed Version: 11.43.0.12, 11.42.1.16 & 11.40.1.14
CVE: -
R911: 0155
Date: 2014-05-26
By: Rack911

Product Description:

cPanel is an easy-to-use control panel that gives web hosts and the website owners they serve, the ability to quickly and easily manage their servers and websites. Web Host Manager (WHM) is a part of the cPanel software, often used by resellers and system administrators.

Vulnerability Description:

When an administrator changes the password belonging to a mailing list via WHM, it is possible for a malicious user to obtain the password in plain-text by monitoring the ps output.

Impact:

We have deemed this vulnerability to be rated as HIGH due to the fact that mailman passwords can be easily obtained if a user monitors the ps output in real time.

Vulnerable Version:

This vulnerability was tested against cPanel prior to the fixed versions below.

Fixed Version:

This vulnerability was patched in cPanel 11.43.0.12, 11.42.1.16 & 11.40.1.14.

Vendor Contact Timeline:

2014-04-11: Vendor contacted via email.
2014-04-14: Vendor confirms vulnerability.
2014-05-19: Vendor issues updates to all builds.
2014-05-26: Rack911 issues security advisory.

cPanel – Configure Customer Contact Symlink Attack (R911-0154)

Monday, May 26th, 2014

Type: Symlink Attack
Location: Local
Impact: Medium
Product: cPanel
Website: http://www.cpanel.net
Vulnerable Version: All versions prior to the fixed builds below.
Fixed Version: 11.43.0.12, 11.42.1.16 & 11.40.1.14
CVE: -
R911: 0154
Date: 2014-05-26
By: Rack911

Product Description:

cPanel is an easy-to-use control panel that gives web hosts and the website owners they serve, the ability to quickly and easily manage their servers and websites. Web Host Manager (WHM) is a part of the cPanel software, often used by resellers and system administrators.

Vulnerability Description:

It is possible for a malicious reseller to access another users contactinfo.yaml file using a symlink attack. Additionally, since the open() is being done as root it may be possible under certain circumstances to open arbitrary files.

Impact:

We have deemed this vulnerability to be rated as MEDIUM due to the fact that content belonging to other users can be accessed, but is limited in nature and must be in YAML format.

Vulnerable Version:

This vulnerability was tested against cPanel prior to the fixed versions below.

Fixed Version:

This vulnerability was patched in cPanel 11.43.0.12, 11.42.1.16 & 11.40.1.14.

Vendor Contact Timeline:

2014-04-11: Vendor contacted via email.
2014-04-14: Vendor confirms vulnerability.
2014-05-19: Vendor issues updates to all builds.
2014-05-26: Rack911 issues security advisory.

cPanel – DNS Zone Common Domain Restriction Bypass (R911-0153)

Monday, May 26th, 2014

Type: Input Validation Failure
Location: Remote
Impact: High
Product: cPanel
Website: http://www.cpanel.net
Vulnerable Version: All versions prior to the fixed builds below.
Fixed Version: 11.43.0.12, 11.42.1.16 & 11.40.1.14
CVE: -
R911: 0153
Date: 2014-05-26
By: Rack911

Product Description:

cPanel is an easy-to-use control panel that gives web hosts and the website owners they serve, the ability to quickly and easily manage their servers and websites. Web Host Manager (WHM) is a part of the cPanel software, often used by resellers and system administrators.

Vulnerability Description:

Due to an input validation failure, it is possible for a malicious user to create a DNS zone such as Hotmail.com or Google.com, bypassing the common domain restriction, which could then be used by the attacker to redirect mail delivery and intercept messages.

Impact:

We have deemed this vulnerability to be rated as HIGH due to the fact that email intended for certain remote domains could be hijacked.

Vulnerable Version:

This vulnerability was tested against cPanel prior to the fixed versions below.

Fixed Version:

This vulnerability was patched in cPanel 11.43.0.12, 11.42.1.16 & 11.40.1.14.

Vendor Contact Timeline:

2014-04-09: Vendor contacted via email.
2014-04-14: Vendor confirms vulnerability.
2014-05-19: Vendor issues updates to all builds.
2014-05-26: Rack911 issues security advisory.

cPanel – DNS Zone Clustering Input Validation Failure (R911-0152)

Monday, May 26th, 2014

Type: Input Validation Failure
Location: Remote
Impact: High
Product: cPanel
Website: http://www.cpanel.net
Vulnerable Version: All versions prior to the fixed builds below.
Fixed Version: 11.43.0.12, 11.42.1.16 & 11.40.1.14
CVE: -
R911: 0152
Date: 2014-05-26
By: Rack911

Product Description:

cPanel is an easy-to-use control panel that gives web hosts and the website owners they serve, the ability to quickly and easily manage their servers and websites. Web Host Manager (WHM) is a part of the
cPanel software, often used by resellers and system administrators.

Vulnerability Description:

It is possible for a malicious reseller to manipulate, delete and/or create any DNS zone on a cPanel server due to an input validation failure within various scripts used by the clustering system. In addition to the input validation failure, some of the vulnerabilities were allowed to happen due to a nullbyte (%00) attack.

Impact:

We have deemed this vulnerability to be rated as HIGH due to the fact that any DNS zone can be effectively hijacked. (cPanel labeled this minor, but we 100% disagree with that assessment given the scope of damage which could be done by an attacker.

Vulnerable Version:

This vulnerability was tested against cPanel prior to the fixed versions below.

Fixed Version:

This vulnerability was patched in cPanel 11.43.0.12, 11.42.1.16 & 11.40.1.14.

Vendor Contact Timeline:

2014-04-09: Vendor contacted via email.
2014-04-10: Vendor confirms vulnerability.
2014-05-19: Vendor issues updates to all builds.
2014-05-26: Rack911 issues security advisory.

cPanel – Safetybits.pl Race Conditions (R911-0151)

Monday, May 26th, 2014

Type: Race Conditions
Location: Local
Impact: High
Product: cPanel
Website: http://www.cpanel.net
Vulnerable Version: All versions prior to the fixed builds below.
Fixed Version: 11.43.0.12, 11.42.1.16 & 11.40.1.14
CVE: -
R911: 0151
Date: 2014-05-26
By: Rack911

Product Description:

cPanel is an easy-to-use control panel that gives web hosts and the website owners they serve, the ability to quickly and easily manage their servers and websites. Web Host Manager (WHM) is a part of the cPanel software, often used by resellers and system administrators.

Vulnerability Description:

Due to a race condition present within safetybits.pl, it is possible for a malicious user to take ownership of various files and/or directories. The safetybits.pl file is used by a few functions within cPanel such as chownpublichtmls, cleanopenwebmail, mkquotas, fixvaliases and fixsuexeccgiscripts.

Impact:

We have deemed this vulnerability to be rated as HIGH due to the fact that files ownership’s can be changed which could lead to a privilege escalation.

Vulnerable Version:

This vulnerability was tested against cPanel prior to the fixed versions below.

Fixed Version:

This vulnerability was patched in cPanel 11.43.0.12, 11.42.1.16 & 11.40.1.14.

Vendor Contact Timeline:

2014-04-03: Vendor contacted via email.
2014-04-07: Vendor confirms vulnerability.
2014-05-19: Vendor issues updates to all builds.
2014-05-26: Rack911 issues security advisory.