cPanel – Configure Customer Contact Symlink Attack (R911-0154)

Type: Symlink Attack
Location: Local
Impact: Medium
Product: cPanel
Website: http://www.cpanel.net
Vulnerable Version: All versions prior to the fixed builds below.
Fixed Version: 11.43.0.12, 11.42.1.16 & 11.40.1.14
CVE: -
R911: 0154
Date: 2014-05-26
By: Rack911

Product Description:

cPanel is an easy-to-use control panel that gives web hosts and the website owners they serve, the ability to quickly and easily manage their servers and websites. Web Host Manager (WHM) is a part of the cPanel software, often used by resellers and system administrators.

Vulnerability Description:

It is possible for a malicious reseller to access another users contactinfo.yaml file using a symlink attack. Additionally, since the open() is being done as root it may be possible under certain circumstances to open arbitrary files.

Impact:

We have deemed this vulnerability to be rated as MEDIUM due to the fact that content belonging to other users can be accessed, but is limited in nature and must be in YAML format.

Vulnerable Version:

This vulnerability was tested against cPanel prior to the fixed versions below.

Fixed Version:

This vulnerability was patched in cPanel 11.43.0.12, 11.42.1.16 & 11.40.1.14.

Vendor Contact Timeline:

2014-04-11: Vendor contacted via email.
2014-04-14: Vendor confirms vulnerability.
2014-05-19: Vendor issues updates to all builds.
2014-05-26: Rack911 issues security advisory.