cPanel – DNS Zone Clustering Input Validation Failure (R911-0152)

Type: Input Validation Failure
Location: Remote
Impact: High
Product: cPanel
Website: http://www.cpanel.net
Vulnerable Version: All versions prior to the fixed builds below.
Fixed Version: 11.43.0.12, 11.42.1.16 & 11.40.1.14
CVE: -
R911: 0152
Date: 2014-05-26
By: Rack911

Product Description:

cPanel is an easy-to-use control panel that gives web hosts and the website owners they serve, the ability to quickly and easily manage their servers and websites. Web Host Manager (WHM) is a part of the
cPanel software, often used by resellers and system administrators.

Vulnerability Description:

It is possible for a malicious reseller to manipulate, delete and/or create any DNS zone on a cPanel server due to an input validation failure within various scripts used by the clustering system. In addition to the input validation failure, some of the vulnerabilities were allowed to happen due to a nullbyte (%00) attack.

Impact:

We have deemed this vulnerability to be rated as HIGH due to the fact that any DNS zone can be effectively hijacked. (cPanel labeled this minor, but we 100% disagree with that assessment given the scope of damage which could be done by an attacker.

Vulnerable Version:

This vulnerability was tested against cPanel prior to the fixed versions below.

Fixed Version:

This vulnerability was patched in cPanel 11.43.0.12, 11.42.1.16 & 11.40.1.14.

Vendor Contact Timeline:

2014-04-09: Vendor contacted via email.
2014-04-10: Vendor confirms vulnerability.
2014-05-19: Vendor issues updates to all builds.
2014-05-26: Rack911 issues security advisory.