cPanel – Password Change Hardlink Arbitrary File Write (R911-0184)

Type: Arbitrary File Write (Symlink)
Location: Local
Impact: Medium
Product: cPanel
Website: http://www.cpanel.net
Vulnerable Version: All versions prior to the fixed builds below.
Fixed Version: 11.50.0.27, 11.48.4.6 & 11.46.3.8
CVE: -
R911: 0184
Date: 2015-07-23
By: RACK911 Labs

Product Description:

cPanel is an easy-to-use control panel that gives web hosts and the website owners they serve, the ability to quickly and easily manage their servers and websites. Web Host Manager (WHM) is a part of the cPanel software, often used by resellers and system administrators.

Vulnerability Description:

It is possible for a malicious user to perform a symlink attack against any file on the server and inject (some) data into the compromised file. This is allowed to happen during the Password Change function that performs various root file operations within the user home directory.

Impact:

We have deemed this vulnerability to be rated as MEDIUM due to the fact that while we can compromise any file on the server, the data that we can write is limited which ruins the effectiveness of this exploit. However, under certain circumstances it *MAY* be possible to obtain root access.

Vulnerable Version:

This vulnerability is believed to exist in all versions prior to the fixed versions below.

Fixed Version:

This vulnerability was patched in cPanel versions 11.50.0.27, 11.48.4.6 & 11.46.3.8.

Vendor Contact Timeline:

2015-05-19: Vendor contacted via email.
2015-05-19: Vendor confirms vulnerability.
2015-07-20: Vendor issues updates to all builds.
2015-07-23: RACK911 Labs issues security advisory.