mailing list archives
cPanel hardlink backup issue
From: Karol Więsek <appelast () drumnbass art pl>
Date: Mon, 18 Oct 2004 11:50:47 +0200
-----BEGIN PGP SIGNED MESSAGE-----
Vendor URL: http://www.cpanel.net
Author: Karol Więsek <appelast () drumnbass art pl>
Date: July 19, 2004
cPanel backup feature allows logged in users to read any file, including
they have not permission to read to.
cPanel is a next generation web hosting control panel system. cPanel is
extremely feature rich as well as include an easy to use web based
interface (GUI). cPanel is designed for the end users of your system and
allows them to control everything from adding / removing email accounts
to administering MySQL databases.
cPanel backup system allows attacker to insert into archive and then
download files, that he does not have permission to access. System
backup follows hard links ( thus it is only possible on the same
partition ) and copies it into tar.gz archive. Attacker could use php,
cgi, crontab or shell access to link file in his public_html to for
example /etc/shadow, and then execute backup ( Backup ->
Generate/Download a Full Backup ).
To exploit this vulnerability just link file you want to grab to some
file in $HOME and execute backup.
Tested on cPanel 9.4.1-RELEASE-64, and confirmed vulnerable.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
-----END PGP SIGNATURE-----
Full-Disclosure - We believe in it.
- cPanel hardlink backup issue Karol Więsek (Oct 18)