The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

[resolved] Possible Security Issue

Discussion in 'Security' started by logikstudios, May 16, 2007.

  1. logikstudios

    logikstudios Well-Known Member

    Joined:
    Nov 2, 2006
    Messages:
    158
    Likes Received:
    0
    Trophy Points:
    0
    Hey. I have just discovered a massive security in the CPANEL 10.9 software. This problem is in the BACKUP FEATURE. If you do remote ftp back onto the same account. It will put the file in the account home directory and it will have this type of stuff accountname:ROOTPASSWORD@serverhostname.com


    This is a major problem and needs to be fixed stright away.

    Thanks,

    Nathaniel
     
  2. cPanelDavidG

    cPanelDavidG Technical Product Specialist

    Joined:
    Nov 29, 2006
    Messages:
    11,279
    Likes Received:
    8
    Trophy Points:
    38
    Location:
    Houston, TX
    cPanel Access Level:
    Root Administrator
    Security issues should be emailed directly to security@cpanel.net so they can be addressed in a prompt manner.

    Remember, the cPanel Staff is not made aware of every thread posted here. While we attempt to assist those posting to the forum where appropriate - many threads may "fall through the cracks." It is for this reason (among many others) the forums are not an official means of communication and it is strongly encouraged that official communications with the cPanel Staff be handled through official channels rather than via the community forums.
     
  3. logikstudios

    logikstudios Well-Known Member

    Joined:
    Nov 2, 2006
    Messages:
    158
    Likes Received:
    0
    Trophy Points:
    0
    Sorry about that. Can you please email them about this.

    Thanks,
    Nathaniel
     
  4. LP-Tim

    LP-Tim Active Member

    Joined:
    Apr 30, 2007
    Messages:
    26
    Likes Received:
    0
    Trophy Points:
    1
    Interesting.

    But why would you do remote FTP backup to the same account?
     
  5. logikstudios

    logikstudios Well-Known Member

    Joined:
    Nov 2, 2006
    Messages:
    158
    Likes Received:
    0
    Trophy Points:
    0
    Because if you wanted to put it into a web directory where you could download it.
     
  6. DaveUsedToWorkHere

    DaveUsedToWorkHere Well-Known Member

    Joined:
    Dec 28, 2001
    Messages:
    689
    Likes Received:
    1
    Trophy Points:
    18

    I'm trying to get a grasp on this. You are sending all backups for a server to a specific account on the same server over ftp?

    What files contain root passwords? It's only account tarballs that are backed up. Here's a FTP backup to my account from the same server:

    Code:
    dave@server1 [~/cpbackup]# cd monthly/
    dave@server1 [~/cpbackup/monthly]# ls
    ./   domain1.tar.gz       domain2.tar.gz   domain3.tar.gz   reseller.tar.gz
    ../  domain4.tar.gz  domain5.tar.gz  
    dave@server1 [~/cpbackup/monthly]# cd ..
    dave@server1 [~/cpbackup]# cd weekly/
    dave@server1 [~/cpbackup/weekly]# ls
    ./   domain1.tar.gz       domain2.tar.gz   domain3.tar.gz   reseller.tar.gz
    ../  domain4.tar.gz  domain5.tar.gz  
    dave@server1 [~/cpbackup/weekly]# cd ..
    dave@server1 [~/cpbackup]# cd daily/
    dave@server1 [~/cpbackup/daily]# ls
    ./   domain1.tar.gz       domain2.tar.gz   domain3.tar.gz   reseller.tar.gz
    ../  domain4.tar.gz  domain5.tar.gz  
    
    
     
  7. DaveUsedToWorkHere

    DaveUsedToWorkHere Well-Known Member

    Joined:
    Dec 28, 2001
    Messages:
    689
    Likes Received:
    1
    Trophy Points:
    18
    I did a grep -R "account:rootpass" * in my backup directory after extracting the archive and got no takers.


    Code:
    dave@server1 [~/cpbackup/daily]# tar -xzf reseller.tar.gz 
    dave@server1 [~/cpbackup/daily]# cd reseller
    root@server1 [/home/dave/cpbackup/daily/reseller]# grep -R "reseller:XXXX" *
    root@server1 [/home/dave/cpbackup/daily/reseller]#
    XXXX intentionally obfuscated
     
  8. LP-Tim

    LP-Tim Active Member

    Joined:
    Apr 30, 2007
    Messages:
    26
    Likes Received:
    0
    Trophy Points:
    1
    Yeah I'm not seeing it either.

    Not sure how this would be any different than backing up to a regular 'ole remote ftp server. Files is files, and ftp is ftp, eh?
     
  9. zigzam

    zigzam Well-Known Member

    Joined:
    May 9, 2005
    Messages:
    206
    Likes Received:
    0
    Trophy Points:
    16
    I can not duplicate this on any of my servers.
     
  10. logikstudios

    logikstudios Well-Known Member

    Joined:
    Nov 2, 2006
    Messages:
    158
    Likes Received:
    0
    Trophy Points:
    0
    Found the problem, I was logged into that account as root. Came from root WHM to the cpanel account.

    Thanks,
     
  11. DaveUsedToWorkHere

    DaveUsedToWorkHere Well-Known Member

    Joined:
    Dec 28, 2001
    Messages:
    689
    Likes Received:
    1
    Trophy Points:
    18
    I'm changing this thread's title as it is not valid
     
Loading...

Share This Page