Type: Arbitrary File Creation
Vulnerable Version: All versions prior to the fixed builds below.
Fixed Version: 220.127.116.11, 18.104.22.168, 22.214.171.124 & 126.96.36.199
cPanel is an easy-to-use control panel that gives web hosts and the website owners they serve, the ability to quickly and easily manage their servers and websites. Web Host Manager (WHM) is a part of the cPanel software, often used by resellers and system administrators.
Logaholic session files were stored in the world-writable /tmp directory. A local attacker with access to the cPanel Logaholic interfaces could create a session file in this directory with a crafted payload intended to execute arbitrary code as the cpanel-logaholic user as the session was loaded by the Logaholic interfaces inside cPanel.
We have deemed this vulnerability to be rated as HIGH due to the fact that while any file can be created as the cpanellogaholic user.
This vulnerability was tested against cPanel 188.8.131.52 and is believed to exist in all versions prior to the fixed builds below.
This vulnerability was patched in cPanel 184.108.40.206, 220.127.116.11, 18.104.22.168 & 22.214.171.124.
Vendor Contact Timeline:
2013-11-07: Vendor contacted via email.
2013-11-10: Vendor confirms vulnerability.
2013-12-16: Vendor issues updates to all builds.
2013-12-18: Rack911 issues security advisory.