cPanel – Reset Root SSH Key (R911-0004)

Type: Authentication Bypass
Impact: Medium
Product: cPanel
Website: http://www.cpanel.net
Vulnerable Version: 11.36.1.5 and earlier.
Fixed Version: 11.38.0.7
CVE: -
R911: 0004
Date: 2013-05-13
By: http://www.rack911.com

Product Description:

cPanel is an easy-to-use control panel that gives web hosts and the website owners they serve, the ability to quickly and easily manage their servers and websites. Web Host Manager (WHM) is a part of the cPanel software, often used by resellers and system administrators.

Vulnerability Description:

WHM fails to restrict access to the Root SSH Key manager and allows a malicious user to generate a new key under /root/.ssh/ and overwrite an existing key if the file name is known or if .id_dsa is used by default.

Proof of Concept:

1. Log into WHM using a reseller account.

2. Open the following URL after the WHM session:

/scripts2/ssh_addkey
/scripts2/ssh_doaddkey?name=&pass=PASSWORD&password2=PASSWORD&type=dsa&keysize=1024

Impact:

We have deemed this vulnerability to be rated as MEDIUM due to the fact that private keys under /root/.ssh/ can be overwritten. Right now it is not possible to use a private key generated by this exploit to gain access.

Vulnerable Version:

This vulnerability was tested against cPanel (WHM) v11.36.1.5.

Fixed Version:

This vulnerability was patched in version 11.38.0.7 or possibly a few builds earlier, we’re not sure since cPanel stopped communicating with us regarding the matter and decided to silently fix. All users are urged to upgrade as soon as possible.

Vendor Contact Timeline:

2013-05-04: Vendor contacted via email.
2013-05-06: Vendor confirms vulnerability.
2013-05-10: Vendor issues v11.38.0.7 update.
2013-05-13: Rack911 issues security advisory.