Solutions for handling symlink attacks

[k-planethost]

that depends from you which patch to use
how can we monitor our servers that patches are working properly.

 

[brianoz]

So which patch we should use yours or Mitio

It doesn't really matter; the nice thing about rack911's is that it's a one-line install (well, actually 4 lines, but one copy and paste into your shell).

 

[brianoz]

that depends from you which patch to use
how can we monitor our servers that patches are working properly.

Create a symlink pointing to the root filesystem or to another user and see if it works or gives an error.

 

[keaza]

i have tried to patch this my self but i have never succeded when they upload a shell into cpanel they norm have a small command line they can use my friend who is a hacker said to me he roots servers this way but with the new kernal he is unable to gain root access..

he did a quick run through of what he does

uploads the shell.php
mkdir /root
Upload .htaccess file

i will tyr get and realse the htaccess file he uploads next time he starts trying to hack my server but thats basicly what he does and i havent found a patch yet

 

[Eboy]

I hate cpanels stance on this so we have created a patch and have been using for some time. It turns FollowSymLinks into SymLinksIfOwnerMatch at the apache source code level.

Interesting.

I have contacted one of my VPS providers upon this issue, which by the way is supossed to be *managed* and their first reply was, and I quote:

Your server Apache service is already built with latest stable release and it is free from those vulnerabilities. You can ignore it now.

When I insisted and mentioned again this thread, then I received this reply:

Yeah I am sure, cPanel forum thread you mentioned is very old one and team has already patched services for all vulnerabilities reported.

When I insisted again, telling them that this patch provided by StevenC is just a couple of weeks old, they said they would contact cPanel Support. And the reply they quote from cPanel Support is this one:

The patch in that forum post is not not developed nor supported by us.

You have "SymLinksIfOwnerMatch" checked in WHM -> Service Configuration -> Apache COnfiguration, so symlinks will only be followed if the owners match.

I'd appreciate your comments on this, specially from StevenC.

Thanks!

 

[StevenC]

Interesting.

I have contacted one of my VPS providers upon this issue, which by the way is supossed to be *managed* and their first reply was, and I quote:



When I insisted and mentioned again this thread, then I received this reply:



When I insisted again, telling them that this patch provided by StevenC is just a couple of weeks old, they said they would contact cPanel Support. And the reply they quote from cPanel Support is this one:



I'd appreciate your comments on this, specially from StevenC.

Thanks!

1.) The latest apache is indeed vulnerable to this 'exploit'.
2.) Yes you can disable the feature as mentioned by cpanel support, but you will encounter internal server messages if someone has 'FollowSymLinks' in their .htaccess. Furthermore, you have to go deeper (read the rest of the thread) to ensure that an end user cannot renable FollowSymLinks.
3.) The patch that I created along with the patch that Mitio created resolves this exploit without having to deal with htaccess files. It drops in and forces FollowSymLinks to act like SymLinksIfOwnerMatch.

The fact that they did not have a clue that its still a vulnerability, shows how 'managed' they are. They don't go outside the norm. Sadly if you want to remain safe you have to steer away from the norm (not just with this problem, but server security in general).

 

[Eboy]

Thanks StevenC, I appreciate your reply.

The patch that I created along with the patch that Mitio created resolves this exploit without having to deal with htaccess files. It drops in and forces FollowSymLinks to act like SymLinksIfOwnerMatch.

I thought one or the other could be applied. You mean both patches should be applied?

 

[StevenC]

Thanks StevenC, I appreciate your reply.



I thought one or the other could be applied. You mean both patches should be applied?

Opps!

Yeah, either one will work separately. Both at the same time would be counter productive.

 

[StevenC]

Just so you all know -- litespeedtech is vulnerable to this also. Follow the earlier symlink workarounds to resolve it (It will not throw internal server errors).

 

[sehh]

cPanel makes it very easy for the attacker. At first I wondered how they could come up with the random names under /home since /home is not readable (go+x only), but apparently if the server is running cPanel, the attacker accesses various world-readable files like /etc/trueuserowners which have the whole list of unix names of the system, so they can easily iterate them under /home.

Bad cPanel... !

 

[brianoz]

cPanel makes it very easy for the attacker. At first I wondered how they could come up with the random names under /home since /home is not readable (go+x only), but apparently if the server is running cPanel, the attacker accesses various world-readable files like /etc/trueuserowners which have the whole list of unix names of the system, so they can easily iterate them under /home.

Bad cPanel... !

One way or another, it's very easy to discover other users on the system, whether via running processes, ps, or guessing. The real issue is preventing them getting into those users' accounts, and that's what we've been discussing here.

 

[sehh]

The only true solution is to run users under a jail within a virtual set of directories, thus the /home will be empty and only contain their own directory. The user shouldn't see a real /etc or just about any other real system directory.

The current PHP implementation allows the user to create a whole remote management tool that can just about do anything to the web server (create symbolic links, act as a shell, read all world-readable files, etc).

The best solution, would be total isolation between users, including the applications that run on the server. Which unfortunately is not possible with the current Linux implementation.

Unless we create a VPS per domain

 

[JeffP.]

cPanel makes it very easy for the attacker. At first I wondered how they could come up with the random names under /home since /home is not readable (go+x only), but apparently if the server is running cPanel, the attacker accesses various world-readable files like /etc/trueuserowners which have the whole list of unix names of the system, so they can easily iterate them under /home.

Bad cPanel... !

cPanel isn't necessary to obtain a list of usernames from a server. Using Linux as an example, /etc/passwd* or /etc/group* can be used instead. Additionally, they contain more information than /etc/trueuserowners.

 

[storminternet]

Hi,

cPanelJeff is right. Hackers can put the various shell programs to compromise /etc/passwd and other necessary files. The plain servers without cPanel being installed on it can also be hacked.

It doesn't matter whether cPanel or any control panel is installed or not. The more important is server security.
It shouldn't be compromised.

 

[minosjl]

hi ,

what should we do with website is already hacked because of this venerability ? , i have read the whole posts and i can see how we can prevent this in feature.Do we need to shutdown the website , because some one get the info of config.php , they really knows about the database login details and all the info of the users in the database.How can we secure this particular website ?

 

[sehh]

Delete all passwords and force the users to reset/create new passwords. Same for any admin passwords. Of course that implies that your software supports empty/disabled passwords and will force the user to submit a new one by verifying it via his email address.

If not, then you could do it manually, reset all passwords to a new random value and send the new password to each user via email. It should be fairly easy to write a quick php script to do something like that.

 

[DomineauX]

I would also suggest that you look for any symlinks and remove any that look suspicious.
You can search for symlinks with:
find /home/username/ -type l

 

[minosjl]

hi,

thanks , i am looking in to this, in the mean time , if we are securing the website depends upon what CMS we are using like we said joomla and wordpress will also prevent this hacking ? . Like implement the encryption methods and deny the admin access to particular users only etc ...

 

[DomineauX]

hi,

thanks , i am looking in to this, in the mean time , if we are securing the website depends upon what CMS we are using like we said joomla and wordpress will also prevent this hacking ? . Like implement the encryption methods and deny the admin access to particular users only etc ...

Absolutely you need to ensure that the site applications like WordPress/Joomla are secured as that is the most likely point of entry. This symlink vulnerability is abused once access has been obtained so you must focus on the was access is obtained as well.

If you need further assistance with security of those applications you should check the forums and google for the applications specifically.

 

[storminternet]

Hi,

One should pay attentions on addons like themes, plugins which comes with the third party applications.
They are also being updated while you update the third party software. Buggy addons are also caused security loopholes.