cPanel – Password Change Hardlink Arbitrary File Write Security Vulnerability

July 23, 2015 - by RACK911 Labs

Product Description:

cPanel is an easy-to-use control panel that gives web hosts and the website owners they serve, the ability to quickly and easily manage their servers and websites. Web Host Manager (WHM) is a part of the cPanel software, often used by resellers and system administrators.

Vulnerability Discussion:

It is possible for a malicious user to perform a symlink attack against any file on the server and inject (some) data into the compromised file. This is allowed to happen during the Password Change function that performs various root file operations within the user home directory.

Vendor Contact Timeline:

2015-05-19: Vendor contacted via email.
2015-05-19: Vendor confirms vulnerability.
2015-07-20: Vendor issues updates to all builds.
2015-07-23: RACK911 Labs issues security advisory.

About Us:

https://www.RACK911Labs.com

RACK911 Labs
1110 Palms Airport Drive, Suite 110
Las Vegas, NV 89119

1-855-RACK911