Type: Privilege Escalation
Vulnerable Version: 5.0.39
Fixed Version: 5.0.40
RVSiteBuilder is browser based site building software that installs directly into cPanel. Its easy-to-follow workflow, social media plugins, and robust content management features makes it easy for even non-programmers to create, market, and maintain a high-end web presence.
A reseller can create a malicious hardlink pointing to any file on the server and take control of that file once the RVSiteBuilder setup is initiated. The end result is that the attacker would be able to gain root access.
Proof of Concept:
Due to the nature of this security flaw, we will not be posting a Proof of Concept until a much later date.
We have deemed this vulnerability to be rated as HIGH due to the fact that root access can be obtained.
This vulnerability was tested against RVSiteBuilder v5.0.39 and is believed to exist in all prior versions.
This vulnerability was patched in RVSiteBuilder v5.0.40.
Vendor Contact Timeline:
2013-08-18: Vendor contacted via email.
2013-08-25: Vendor confirms vulnerability.
2013-09-02: Vendor issues update.
2013-09-03: Rack911 issues security advisory.