The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

cPanel TSR-2015-0002 Full Disclosure

Discussion in 'cPanel Announcements' started by cPanelCory, Mar 17, 2015.

  1. cPanelCory

    cPanelCory Developer - cPanel Security Team
    Staff Member

    Joined:
    Jan 18, 2008
    Messages:
    69
    Likes Received:
    5
    Trophy Points:
    8
    Location:
    Houston
    cPanel Access Level:
    Root Administrator
    cPanel TSR-2015-0002 Full Disclosure

    SEC-2

    Summary

    Multiple vulnerabilities via ExpVar overexpansion.

    Security Rating

    cPanel has assigned this vulnerability a CVSSv2 score of 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N)

    Description

    The WHM, cPanel, and Webmail interfaces use a common routine named "expvar" for interpolating user input and some cPanel template variables. In many interfaces, this function could be tricked into over interpolating user-supplied inputs to bypass context specific escaping or execute arbitrary code across privilege boundaries.

    Credits

    This issue was discovered by the cPanel Security Team.

    Solution

    This issue is resolved in the following builds:
    11.48.1.3
    11.46.3.1
    11.44.3.1

    SEC-3

    Summary

    Arbitrary code execution via secondary ExpVar expansion in API2 engine.

    Security Rating

    cPanel has assigned this vulnerability a CVSSv2 score of 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N)

    Description

    The WHM, cPanel, and Webmail interfaces use a common routine named "expvar" for interpolating user input and some cPanel template variables. In the cPanel API2 templating and tag engine, this function was called on tainted data returned from API2 calls which allowed the execution of arbitrary code across privilege boundaries.

    Credits

    This issue was discovered by the cPanel Security Team.

    Solution

    This issue is resolved in the following builds:
    11.48.1.3
    11.46.3.1
    11.44.3.1

    SEC-6

    Summary

    Security token disclosed during xfer logins.

    Security Rating

    cPanel has assigned this vulnerability a CVSSv2 score of 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N)

    Description

    When doing an xfer login from WHM to cPanel or from cPanel to a webmail virtual user, the security token was disclosed to the lesser privileged user. This allowed possible XSRF attacks into the higher privileged interface.

    Credits

    This issue was discovered by the cPanel Security Team.

    Solution

    This issue is resolved in the following builds:
    11.48.1.3
    11.46.3.1
    11.44.3.1

    SEC-9

    Summary

    Limited path traversal and configuration leak in Mailman Cache Regeneration.

    Security Rating

    cPanel has assigned this vulnerability a CVSSv2 score of 2.1 (AV:N/AC:H/Au:S/C:P/I:N/A:N)

    Description

    When regenerating the Mailman mailing list configuration cache for a user, a list of mailing list names is provided. These mailing list names were not checked for validity or ownership. This allowed an attacker to test for the existence of files on the system or display a limited set of configuration keys for arbitrary mailing lists.

    Credits

    This issue was discovered by the cPanel Security Team.

    Solution

    This issue is resolved in the following builds:
    11.48.1.3
    11.46.3.1
    11.44.3.1

    SEC-10

    Summary

    Format string vulnerability in maketext API1 function.

    Security Rating

    cPanel has assigned this vulnerability a CVSSv2 score of 4.9 (AV:N/AC:M/Au:S/C:P/I:P/A:N)

    Description

    cPanel & WHM uses the Locale::Maketext Perl library to provide translations for users. Locale::Maketext is vulnerable to string attacks if an untrusted user is allowed to provide the maketext format string. cPanel and Webmail accounts were allowed to call this function directly using remote API1 commands. With specially crafted format strings, this allowed webmail virtual accounts to run arbitrary code with the effective UID and GID of the cPanel account that owned the virtual account.

    Credits

    This issue was discovered by the cPanel Security Team.

    Solution

    This issue is resolved in the following builds:
    11.48.1.3
    11.46.3.1
    11.44.3.1

    SEC-12

    Summary

    Limited arbitrary file chmod in cpsrvd.

    Security Rating

    cPanel has assigned this vulnerability a CVSSv2 score of 3.5 (AV:N/AC:M/Au:S/C:N/I:P/A:N)

    Description

    There was a race condition during a chmod call after a UID/GID switch to the app user. This allowed an authenticated attacker to chmod arbitrary files on the server using the privileges of the app user.

    Credits

    This issue was discovered by the cPanel Security Team.

    Solution

    This issue is resolved in the following builds:
    11.48.1.3
    11.46.3.1
    11.44.3.1

    SEC-13

    Summary

    Convertmaildir script reveals contents of arbitrary directories.

    Security Rating

    cPanel has assigned this vulnerability a CVSSv2 score of 2.1 (AV:N/AC:H/Au:S/C:P/I:N/A:N)

    Description

    When converting from an mbox-file type email account, the convertmaildir script reads the content of a user's ~/mail directory. This directory read was performed as root. By creating a symlink to another directory, the script could be tricked into revealing the file names contained within the target location.

    Credits

    This issue was discovered by the cPanel Security Team.

    Solution

    This issue is resolved in the following builds:
    11.48.1.3
    11.46.3.1
    11.44.3.1

    SEC-15

    Summary

    Stored XSS in /frontend/x3/stats/lastvisit_legacy.html.

    Security Rating

    cPanel has assigned this vulnerability a CVSSv2 score of 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)

    Description

    The "Legacy" Latest-Visitors page in X3 includes generated links to the referring URIs of website visitors. An attacker could insert values into the referrer string that would cause arbitrary javascript to run when the links were clicked.

    Credits

    This issue was discovered by Mateusz Goik.

    Solution

    This issue is resolved in the following builds:
    11.48.1.3
    11.46.3.1
    11.44.3.1

    SEC-16

    Summary

    Stored XSS in /cgi-sys/guestbook.cgi.

    Security Rating

    cPanel has assigned this vulnerability a CVSSv2 score of 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)

    Description

    The cPanel Guestbook allows visitors to include a link-back URL on submitted entries. An attacker could insert arbitrary Javascript into this URL, which would run when clicked by other visitors to the guestbook.

    Credits

    This issue was discovered by Mateusz Goik.

    Solution

    This issue is resolved in the following builds:
    11.48.1.3
    11.46.3.1
    11.44.3.1

    SEC-17

    Summary

    Arbitrary code execution via ExpVar expansion in UI_finishaction API1 command.

    Security Rating

    cPanel has assigned this vulnerability a CVSSv2 score of 3.6 (AV:N/AC:H/Au:S/C:P/I:P/A:N)

    Description

    The WHM, cPanel, and Webmail interfaces use a common routine named "expvar" for interpolating user input and some cPanel template variables. In the cPanel UI_finishaction API1 call, the function was called on tainted data provided by the cPanel user allowing the execution of arbitrary code that could bypass demo or jailshell account restrictions.

    Credits

    This issue was discovered by the cPanel Security Team.

    Solution

    This issue is resolved in the following builds:
    11.48.1.3
    11.46.3.1
    11.44.3.1

    SEC-18

    Summary

    Self-XSS vulnerability in /backend/mailappsetup.cgi.

    Security Rating

    cPanel has assigned this vulnerability a CVSSv2 score of 2.1 (AV:N/AC:H/Au:S/C:N/I:P/A:N)

    Description

    The mailappsetup.cgi script generates a ZIP file containing a user's configuration data for Mail.app. The name of this ZIP file is generated based upon query parameters passed to the script. These parameters were not sufficiently sanitized. An attacker could use these parameters to conduct an HTTP response splitting attack to inject arbitrary HTTP headers and HTML content into the response returned by the server.

    Credits

    This issue was discovered by Mateusz Goik.

    Solution

    This issue is resolved in the following builds:
    11.48.1.3
    11.46.3.1
    11.44.3.1

    SEC-19

    Summary

    Self-XSS in multiple interfaces via QUERY_STRING.

    Security Rating

    cPanel has assigned this vulnerability a CVSSv2 score of 2.1 (AV:N/AC:H/Au:S/C:N/I:P/A:N)

    Description

    Multiple interfaces within cPanel and WHM reflected the raw QUERY_STRING back to the browser. This raw QUERY_STRING was not processed or encoded beyond the URI encoding performed by the browser itself. Some browsers encode only a limited set of characters in query strings, allowing unsafe javascript to be injected into the rendered page.

    Credits

    This issue was discovered by the cPanel Security Team.

    Solution

    This issue is resolved in the following builds:
    11.48.1.3
    11.46.3.1
    11.44.3.1

    SEC-20

    Summary

    Arbitrary code execution for webmail accounts via printhelp API1 command.

    Security Rating

    cPanel has assigned this vulnerability a CVSSv2 score of 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N)

    Description

    The printhelp API1 function expanded arguments passed to it with ExpVar twice. By passing a carefully crafted request to a webmail page utilizing this function, a webmail virtual account could execute arbitrary code as the cPanel user.

    Credits

    This issue was discovered by the cPanel Security Team.

    Solution

    This issue is resolved in the following builds:
    11.48.1.3
    11.46.3.1
    11.44.3.1

    SEC-21

    Summary

    Reflected XSS vulnerability in /whm, /cpanel, and /webmail redirects.

    Security Rating

    cPanel has assigned this vulnerability a CVSSv2 score of 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)

    Description

    The standard redirects from Apache into cPanel & WHM services retain portions of the URI provided by the user. This data was not correctly escaped for rendering into a javascript string, allowing unsafe javascript to be injected into the rendered page for some browsers.

    Credits

    This issue was discovered by Trustwave.

    Solution

    This issue is resolved in the following builds:
    11.48.1.3


    The PGP-Signed message can be read here: http://cpanel.net/wp-content/uploads/2015/03/TSR-2015-0002-Disclosure.txt
     
    #1 cPanelCory, Mar 17, 2015
    Last edited: Jul 20, 2015
    brittbratt likes this.
Loading...

Share This Page