cPanel – Backup Symlink Privilege Escalation Security Vulnerability

July 23, 2015 - by RACK911 Labs

Product Description:

cPanel is an easy-to-use control panel that gives web hosts and the website owners they serve, the ability to quickly and easily manage their servers and websites. Web Host Manager (WHM) is a part of the cPanel software, often used by resellers and system administrators.

Vulnerability Discussion:

It is possible for a malicious user to perform a symlink attack against key files on the server to escalate their privileges to root access. This is allowed to happen during the Generate Full Backup function that performs various root file operations within the user home directory.

Vendor Contact Timeline:

2015-05-14: Vendor contacted via email.
2015-05-14: Vendor confirms vulnerability.
2015-07-20: Vendor issues updates to all builds.
2015-07-23: RACK911 Labs issues security advisory.

About Us:

https://www.RACK911Labs.com

RACK911 Labs
1110 Palms Airport Drive, Suite 110
Las Vegas, NV 89119

1-855-RACK911