cPanel TSR-2017-0001 Full Disclosure

SEC-196

Summary

Fixed password used for Munin MySQL test account.

Security Rating

cPanel has assigned this vulnerability a CVSSv2 score of 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N)

Description

The Munin monitoring tool includes a plugin to check the status of the MySQL service. This plugin used a dedicated test MySQL user to provide this functionality. The password set for this user was identical to the username. In cPanel’s current configuration of Munin, this MySQL user is no longer required and has been removed.

Credits

This issue was discovered by the cPanel Security Team.

Solution

This issue is resolved in the following builds:
62.0.4
60.0.35
58.0.43
56.0.43
54.0.36

SEC-197

Summary

Self-XSS in paper_lantern password change screen.

Security Rating

cPanel has assigned this vulnerability a CVSSv2 score of 2.1 (AV:N/AC:H/Au:S/C:N/I:P/A:N)

Description

Certain form variables on the password change screen could be interpreted as javascript markup. This allowed an attacker to inject a malicious payload into the page.

Credits

This issue was discovered by the cPanel Security Team.

Solution

This issue is resolved in the following builds:
62.0.4
60.0.35
58.0.43
56.0.43
54.0.36

SEC-198

Summary

Reflected XSS in reset password interfaces.

Security Rating

cPanel has assigned this vulnerability a CVSSv2 score of 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)

Description

The user form variable on the password change screen could be interpreted as javascript markup. This allowed an attacker to inject a malicious payload into the page.

Credits

This issue was discovered by the cPanel Security Team.

Solution

This issue is resolved in the following builds:
62.0.4
60.0.35
58.0.43
56.0.43

SEC-199

Summary

Self-XSS in webmail Password and Security page.

Security Rating

cPanel has assigned this vulnerability a CVSSv2 score of 2.1 (AV:N/AC:H/Au:S/C:N/I:P/A:N)

Description

Certain form variables on the webmail password and security page could be interpreted as javascript markup. This allowed an attacker to inject a malicious payload into the page.

Credits

This issue was discovered by the cPanel Security Team.

Solution

This issue is resolved in the following builds:
62.0.4
60.0.35
58.0.43
56.0.43
54.0.36

SEC-201

Summary

Arbitrary file read via Exim valiases.

Security Rating

cPanel has assigned this vulnerability a CVSSv2 score of 6.8 (AV:N/AC:L/Au:S/C:C/I:N/A:N)

Description

When processing the valiases for a user, Exim was running as the root user. By creating a valias that included other files, an attacker was able to read arbitrary files as the root user.

Credits

This issue was discovered by RACK911Labs.com.

Solution

This issue is resolved in the following builds:
62.0.4
60.0.35
58.0.43

SEC-204

Summary

Exim piped filters ran as wrong user when delivering to a system user.

Security Rating

cPanel has assigned this vulnerability a CVSSv2 score of 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)

Description

Piped commands executed by the central_user_filter were run as the nobody user. Now the filters are run as the system user’s UID.

Credits

This issue was discovered by the cPanel Security Team.

Solution

This issue is resolved in the following builds:
62.0.4
60.0.35
58.0.43
56.0.43
54.0.36

SEC-205

Summary

Leech Protect did not protect certain directories.

Security Rating

cPanel has assigned this vulnerability a CVSSv2 score of 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)

Description

The Leech Protect system allows admins to detect unusual amounts of activity on password protected directories. This system was not functioning on directories with a two character name.

Credits

This issue was discovered by the cPanel Security Team.

Solution

This issue is resolved in the following builds:
62.0.4
60.0.35
58.0.43
56.0.43
54.0.36

SEC-206

Summary

Exim transports could be run as the nobody user.

Security Rating

cPanel has assigned this vulnerability a CVSSv2 score of 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N)

Description

It was possible to run exim transports as the nobody user if the receiving email domain was removed during delivery. Transports will now run as the proper user even if the domain no longer exists.

Credits

This issue was discovered by the cPanel Security Team.

Solution

This issue is resolved in the following builds:
62.0.4
60.0.35
58.0.43
56.0.43
54.0.36

SEC-207

Summary

Improper ACL checks in xml-api for Rearrange Account.

Security Rating

cPanel has assigned this vulnerability a CVSSv2 score of 2.1 (AV:N/AC:H/Au:S/C:P/I:N/A:N)

Description

Using the ‘fetch_transfer_session_log’ API, it was possible to fetch transfer information created by other resellers. This could reveal potentially sensitive information to an attacker.

Credits

This issue was discovered by RACK911Labs.com.

Solution

This issue is resolved in the following builds:
62.0.4
60.0.35
58.0.43
56.0.43
54.0.36

SEC-209

Summary

SSL certificate generation in WHM used an unreserved email address.

Security Rating

cPanel has assigned this vulnerability a CVSSv2 score of 2.1 (AV:N/AC:H/Au:S/C:P/I:N/A:N)

Description

In WHM, if you generate a certificate using the “Generate an SSL Certificate and Signing Request” interface and select “When complete, email me the certificate, key, and CSR”, it used “admin@” as the from address. The account name “admin” is not reserved in cPanel & WHM, so if this account was created, it would intercept any replies or bounces.

Credits

This issue was discovered by the cPanel Security Team.

Solution

This issue is resolved in the following builds:
62.0.4
60.0.35
58.0.43
56.0.43
54.0.36

SEC-210

Summary

Account ownership not enforced by has_mycnf_for_cpuser WHM API call.

Security Rating

cPanel has assigned this vulnerability a CVSSv2 score of 2.1 (AV:N/AC:H/Au:S/C:P/I:N/A:N)

Description

The has_mycnf_for_cpuser WHM API call did not verify the caller’s ownership of the specified account. This could allow for a limited amount of information about the user’s MySQL configuration to be leaked.

Credits

This issue was discovered by the cPanel Security Team.

Solution

This issue is resolved in the following builds:
62.0.4
60.0.35
58.0.43
56.0.43
54.0.36

SEC-211

Summary

Stored XSS Vulnerability in WHM Account Suspension List interface.

Security Rating

cPanel has assigned this vulnerability a CVSSv2 score of 3.5 (AV:N/AC:M/Au:S/C:N/I:P/A:N)

Description

When viewing the WHM Account Suspension List with the ‘nohtml’ flag enabled, the response to the browser was sent with the ‘Content-type’ header set to ‘test/html’. This caused text to be misinterpreted as html markup.

Credits

This issue was discovered by the cPanel Security Team.

Solution

This issue is resolved in the following builds:
62.0.4
60.0.35
58.0.43
56.0.43
54.0.36

SEC-212

Summary

Format string injection vulnerability in cgiemail.

Security Rating

cPanel has assigned this vulnerability a CVSSv2 score of 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)

Description

The ability to supply arbitrary format strings to cgiemail and cgiecho allowed code execution whenever a user was able to provide a cgiemail template file. Format strings in cgiemail templates are now restricted to simple %s, %U and %H sequences.
Credits

This issue was discovered by the cPanel Security Team.

Solution

This issue is resolved in the following builds:
60.0.35
58.0.43
56.0.43
54.0.36

SEC-213

Summary

WHM ‘enqueue_transfer_item’ API allowed resellers to queue non rearrange modules.

Security Rating

cPanel has assigned this vulnerability a CVSSv2 score of 2.1 (AV:N/AC:H/Au:S/C:N/I:N/A:P)

Description

The ‘enqueue_transfer_item’ API allowed resellers with the ‘rearrange-accts’ ACL to add items from arbitrary Whostmgr::Transfers::Session modules. This could have potentially allowed for a reseller with the ‘rearrange-accts’ ACL to initiate a remote transfer or perform other restricted operations.

Credits

This issue was discovered by the cPanel Security Team.

Solution

This issue is resolved in the following builds:
62.0.4
60.0.35
58.0.43
56.0.43

SEC-214

Summary

Open redirect vulnerability in cgiemail.

Security Rating

cPanel has assigned this vulnerability a CVSSv2 score of 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N)

Description

The cgiemail and cgiecho binaries served as an open redirect due to their handling of the “success” and “failure” parameters. These redirects are now limited to the domain that handled the request.

Credits

This issue was discovered by the cPanel Security Team.

Solution

This issue is resolved in the following builds:
60.0.35
58.0.43
56.0.43
54.0.36

SEC-215

Summary

HTTP header injection vulnerability in cgiemail.

Security Rating

cPanel has assigned this vulnerability a CVSSv2 score of 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)

Description

Case SEC-215: The handling of redirects in cgiemail and cgiecho did not protect against the injection of additional HTTP headers. Newline characters are now stripped from the redirect location to protect against this.

Credits

This issue was discovered by the cPanel Security Team.

Solution

This issue is resolved in the following builds:
60.0.35
58.0.43
56.0.43
54.0.36

SEC-216

Summary

Reflected XSS vulnerability in cgiemail addendum handling.

Security Rating

cPanel has assigned this vulnerability a CVSSv2 score of 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)

Description

The “addendum” parameter was reflected without any escaping in success and error messages produced by cgiemail and cgiecho. This output is now html escaped.

Credits

This issue was discovered by the cPanel Security Team.

Solution

This issue is resolved in the following builds:
60.0.35
58.0.43
56.0.43
54.0.36

For the PGP-Signed version of this announcement please see: https://news.cpanel.com/wp-content/uploads/2017/01/TSR-2017-0001.disclosure.signed.txt