Possible Security Flaw [MERGED]

[derekivey]

Hi,

Today in cPanel I found out that the link it gives you to click to download today's backup can easily get someone elses files. All you do is change the domain in the link and you have access to backups of anyone on that server. Is there a setting to fix it? Or is that something that the cPanel staff aren't aware of.

Thanks,
Derek

[HostMerit]

That's QUITE bad accutally - CPanel any word on this? They will probably ask you to add to Bugzilla, regardless that it's their error

[chirpy]

Well, that's what bugzilla is for, to list bugs. You should email security@cpanel.net immediately if you believe you've found a security bug.

[meisam]

hello,

i was doing backups in my system and i found a bug. any user who is logged in can get another users backup. ex.

any user logs in to their cPanel account. if they go to https://1.2.3.4:2083/getbackup/backu...29-2005.tar.gz

they can get the backup of domainname.tld. this can be done for ALL Accounts.

[chirpy]

You need to email such issues to security@cpanel.net and log it in bugzilla as posting here will not bring it to cPanel's attention.

[darren]

Hello,

Are you referring to a URL such as this :
https://host.server.tld:2083/getback...30-2005.tar.gz
?
If so, you are still getting your own backup, you are just downloading it under a different name.

Thanks,
Darren

[dgbaker]

False error, you can put any word there and it will still be the backup of the correct domain.