Yes, there's a critical Denial of Service vulnerability in cPHulkd. Yes you've already been told about it. Yes, it's affecting customers. Over the past 4 years I've assisted no lest than 130 cPanel customers who have been victim to this.
The attack is simple, and often not even intentional. Dozens of bots from all over the world attempt to log in to SSH or WHM using the "root" account. Most servers get thousands of these login attempts per day. Each attacker gets locked out after a default of 5 attempts. But several attackers hit at the same time, and after 15 attempts, the "root" account is locked out completely for 15 minutes. And 15 minutes later, the process starts over again. It isn't long before the hapless admin ends up putting himself on the two-week blacklist just by trying to get access to his own server.
I've talked to dozens of customers who have completely lost access to their servers because of this horrible feature. The official "solution" is to white-list the admin's IP, but if the admin doesn't have a static IP then this isn't an option at all.
Yes, this is a true security vulnerability; it can be leveraged by a determined attacker to prevent an administrator from logging in to stop any other sort of attack if the server is hacked. Since cPhulkd conveniently blocks ALL authentication for a given account, not just through cPanel but also SSH and every other avenue, the administrator is prevented from getting root access on his box at all by any means, allowing the attacker to proceed without fear of being stopped by the admin. Since many attackers have an entire botnet at their disposal, getting control of enough IPs to execute such an attack is no problem at all.
What's more, there isn't even the option to disable the account lock-out feature. So either you live with a vulnerable server, or you disable cPhulkd altogether. Those are the only two options users have.
This is absurd. This is stupid. This shows a complete lack of critical thinking or imagination.
I've reported this vulnerability no less than a dozen times by all sorts of channels over the past four years. I've sent patches, bug reports, security alerts, anything I could possibly think of. The response has invariably been moderate intrigue to the initial report, and then nothing. Nothing ever gets fixed, even though I've sent you the appropriate code several times.
cPanel must ship with account lockout disabled by default. No other configuration is remotely sensible.
The attack is simple, and often not even intentional. Dozens of bots from all over the world attempt to log in to SSH or WHM using the "root" account. Most servers get thousands of these login attempts per day. Each attacker gets locked out after a default of 5 attempts. But several attackers hit at the same time, and after 15 attempts, the "root" account is locked out completely for 15 minutes. And 15 minutes later, the process starts over again. It isn't long before the hapless admin ends up putting himself on the two-week blacklist just by trying to get access to his own server.
I've talked to dozens of customers who have completely lost access to their servers because of this horrible feature. The official "solution" is to white-list the admin's IP, but if the admin doesn't have a static IP then this isn't an option at all.
Yes, this is a true security vulnerability; it can be leveraged by a determined attacker to prevent an administrator from logging in to stop any other sort of attack if the server is hacked. Since cPhulkd conveniently blocks ALL authentication for a given account, not just through cPanel but also SSH and every other avenue, the administrator is prevented from getting root access on his box at all by any means, allowing the attacker to proceed without fear of being stopped by the admin. Since many attackers have an entire botnet at their disposal, getting control of enough IPs to execute such an attack is no problem at all.
What's more, there isn't even the option to disable the account lock-out feature. So either you live with a vulnerable server, or you disable cPhulkd altogether. Those are the only two options users have.
This is absurd. This is stupid. This shows a complete lack of critical thinking or imagination.
I've reported this vulnerability no less than a dozen times by all sorts of channels over the past four years. I've sent patches, bug reports, security alerts, anything I could possibly think of. The response has invariably been moderate intrigue to the initial report, and then nothing. Nothing ever gets fixed, even though I've sent you the appropriate code several times.
cPanel must ship with account lockout disabled by default. No other configuration is remotely sensible.
