cPanel TSR-2019-0001 Full Disclosure | cPanel Newsroom

Yesterday we released new builds for versions 70, 76, and 78. These updates provided targeted changes to address security concerns with the cPanel & WHM product. Below is the full disclosure of the updates that were included in these builds.

SEC-415

Summary

Internal data disclosed to OpenID providers.

Security Rating

cPanel has assigned this vulnerability a CVSSv3 score of 2.2 CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N

Description

The “state” parameter passed to OpenID providers during OpenID authentication included connection information that was not necessary for the OpenID provider to authenticate the user. The connection state information is now stored in the user’s session.

Credits

This issue was discovered by the cPanel Security Team.

Solution

This issue is resolved in the following builds:
78.0.2
76.0.18
70.0.63

SEC-460

Summary

Demo accounts allowed to link with OpenID providers.

Security Rating

cPanel has assigned this vulnerability a CVSSv3 score of 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Description

cPanel and Webmail demo accounts are normally prevented from modifying their own authentication settings. This restriction was not enforced correctly during the initial OpenID handshake performed by cpsrvd. As a result, demo accounts could be linked with an OpenID provider from the login interfaces. Changelog: Demo accounts allowed to link with OpenID providers.

Credits

This issue was discovered by the cPanel Security Team.

Solution

This issue is resolved in the following builds:
78.0.2
76.0.18
70.0.63

SEC-466

Summary

Arbitrary file read via Passenger adminbin.

Security Rating

cPanel has assigned this vulnerability a CVSSv3 score of 6.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Description

When setting up a new Passenger application, the configuration values passed in by the user are not adequately validated. This results in invalid values placed into the Apache configuration file. This can allow for arbitrary data to be read by the user.

Credits

This issue was discovered by the cPanel Security Team.

Solution

This issue is resolved in the following builds:
78.0.2
76.0.18
70.0.63

SEC-472

Summary

Maketext format string injection in Email “store_filter” UAPI.

Security Rating

cPanel has assigned this vulnerability a CVSSv3 score of 3.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Description

The Email “store_filter” UAPI call passes an error message directly as a Locale::Maketext format string. It is possible to craft a filter to manipulate this error message and execute arbitrary code. Changelog: Maketext format string injection in Email “store_filter” UAPI.

Credits

This issue was discovered by the cPanel Security Team.

Solution

This issue is resolved in the following builds:
78.0.2
76.0.18

SEC-473

Summary

Demo account limited arbitrary file write via DCV UAPI calls.

Security Rating

cPanel has assigned this vulnerability a CVSSv3 score of 5.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Description

The “check_domains_via_http” and “ensure_domains_can_pass_dcv” UAPI calls in the module are allowed for demo accounts. These calls accept a filename, extension, and a set of allowed characters to write into the DCV file. A demo account can misuse this functionality to create files on the server with limited control over their contents. Changelog: Demo account limited arbitrary file write via DCV UAPI calls.

Credits

This issue was discovered by the cPanel Security Team.

Solution

This issue is resolved in the following builds:
78.0.2
76.0.18
70.0.63

SEC-474

Summary

Maketext format string injection in DCV “check_domains_via_dns” UAPI.

For the PGP-signed message, please see TSR-2019-0001 Full Disclosure – signed.

More Information

To ensure that you receive up-to-date product news from cPanel, we encourage you to subscribe to the Product and Security updates mailing lists: cPanel Mailing List.

For the PGP-signed message, please see TSR-2019-0001 Full Disclosure – signed.

cPanel is a control panel for Web Hosting Providers available here – Cloud Server cPanel. Contact us to find out our latest offers!

Comments are closed.

>