cPanel TSR-2019-0001 Full Disclosure
Yesterday cPanel released new builds for versions 70, 76, and 78. These updates provided targeted changes to address security concerns with the cPanel & WHM product. Below is the full disclosure of the updates that were included in these builds.
SEC-415
Summary
Internal data disclosed to OpenID providers.
Security Rating
cPanel has assigned this vulnerability a CVSSv3 score of 2.2 CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
Description
The “state” parameter passed to OpenID providers during OpenID authentication included connection information that was not necessary for the OpenID provider to authenticate the user. The connection state information is now stored in the user’s session.
Credits
This issue was discovered by the cPanel Security Team.
Solution
This issue is resolved in the following builds:
78.0.2
76.0.18
70.0.63
SEC-460
Summary
Demo accounts allowed to link with OpenID providers.
Security Rating
cPanel has assigned this vulnerability a CVSSv3 score of 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Description
cPanel and Webmail demo accounts are normally prevented from modifying their own authentication settings. This restriction was not enforced correctly during the initial OpenID handshake performed by cpsrvd. As a result, demo accounts could be linked with an OpenID provider from the login interfaces. Changelog: Demo accounts allowed to link with OpenID providers.
Credits
This issue was discovered by the cPanel Security Team.
Solution
This issue is resolved in the following builds:
78.0.2
76.0.18
70.0.63
SEC-466
Summary
Arbitrary file read via Passenger adminbin.
Security Rating
cPanel has assigned this vulnerability a CVSSv3 score of 6.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Description
When setting up a new Passenger application, the configuration values passed in by the user are not adequately validated. This results in invalid values placed into the Apache configuration file. This can allow for arbitrary data to be read by the user.
Credits
This issue was discovered by the cPanel Security Team.
Solution
This issue is resolved in the following builds:
78.0.2
76.0.18
70.0.63
SEC-472
Summary
Maketext format string injection in Email “store_filter” UAPI.
Security Rating
cPanel has assigned this vulnerability a CVSSv3 score of 3.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Description
The Email “store_filter” UAPI call passes an error message directly as a Locale::Maketext format string. It is possible to craft a filter to manipulate this error message and execute arbitrary code. Changelog: Maketext format string injection in Email “store_filter” UAPI.
Credits
This issue was discovered by the cPanel Security Team.
Solution
This issue is resolved in the following builds:
78.0.2
76.0.18
SEC-473
Summary
Demo account limited arbitrary file write via DCV UAPI calls.
Security Rating
cPanel has assigned this vulnerability a CVSSv3 score of 5.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Description
The “check_domains_via_http” and “ensure_domains_can_pass_dcv” UAPI calls in the module are allowed for demo accounts. These calls accept a filename, extension, and a set of allowed characters to write into the DCV file. A demo account can misuse this functionality to create files on the server with limited control over their contents. Changelog: Demo account limited arbitrary file write via DCV UAPI calls.
Credits
This issue was discovered by the cPanel Security Team.
Solution
This issue is resolved in the following builds:
78.0.2
76.0.18
70.0.63
SEC-474
Summary
Maketext format string injection in DCV “check_domains_via_dns” UAPI.
For the PGP-signed message, please see TSR-2019-0001 Full Disclosure – signed.
More Information
To ensure that you receive up-to-date product news from cPanel, we encourage you to subscribe to the Product and Security updates mailing lists: cPanel Mailing List.
For the PGP-signed message, please see TSR-2019-0001 Full Disclosure – signed.
مدیریت سرور پشتیبانی و مشاوره – ثبت دامنه