cPanel – Password Change Hardlink Arbitrary File Write Security Vulnerability
cPanel is an easy-to-use control panel that gives web hosts and the website owners they serve, the ability to quickly and easily manage their servers and websites. Web Host Manager (WHM) is a part of the cPanel software, often used by resellers and system administrators.
It is possible for a malicious user to perform a symlink attack against any file on the server and inject (some) data into the compromised file. This is allowed to happen during the Password Change function that performs various root file operations within the user home directory.
Vendor Contact Timeline:
2015-05-19: Vendor contacted via email.
2015-05-19: Vendor confirms vulnerability.
2015-07-20: Vendor issues updates to all builds.
2015-07-23: RACK911 Labs issues security advisory.
1110 Palms Airport Drive, Suite 110
Las Vegas, NV 89119