Softaculous – Important Security Update Directory Traversal (Root Access)

=> http://blog.solidshellsecurity.com/2013/05/06/softaculous-important-security-update-directory-traversal-root-access/

Just a warning letting everyone know.

Product Description:
Softaculous is the leading auto installer with over 300 applications that can be installed by a click of the mouse. The software is in use by thousands of web hosting companies and works with various control panels such as cPanel, Plesk, DirectAdmin, InterWorx and H-Sphere.
Vulnerability Description:
An attacker posing as a reseller can access Softaculous via WHM and using a certain URL open the error page that is supposed to be restricted to root users.
By default the error page will open a log file called error_log.log under the scripts directory, however an attacker can force the error page to read and/or delete any file on the server due to a fundamental flaw in WHM that allows plugins to be executed as root.
Proof of Concept:
Due to the nature of this vulnerability, a Proof of Concept will be released one week from now to give affected users a chance to upgrade.
Impact:
We have deemed this vulnerability to be rated as CRITICAL due to the fact that Softaculous when accessed via WHM is done so as root and can read any file regardless of ownership. (The error page will also allow the attacker the ability to wipe any file which could potentially render a server inoperable.)
Vulnerable Version:
This vulnerability was tested against Softaculous v4.2.2 for cPanel but is also confirmed to work under InterWorx with some slight changes to the exploit code.
Fixed Version:
This vulnerability was patched in version v4.2.3.
Vendor Contact Timeline:
2013-05-03: Vendor contacted via email.
2013-05-04: Vendor confirms vulnerability.
2013-05-06: Vendor issues v4.2.3 update.
2013-05-06: Rack911 issues security advisory.
â€”
======================================================================
Type: Directory Traversal
Impact: Low
Product: Softaculous
Website: http://www.softaculous.com
Vulnerable Version: 4.2.2
Fixed Version: 4.2.3
CVE: -
Date: 2013-05-06
By: http://www.rack911.com
======================================================================
Product Description:
â€”â€”â€”â€”â€”â€”â€“
Softaculous is the leading auto installer with over 300 applications that can be installed by a click of the mouse. The software is in use by thousands of web hosting companies and works with various control panels such as cPanel, Plesk, DirectAdmin, InterWorx and H-Sphere.
Vulnerability Description:
â€”â€”â€”â€”â€”â€”â€”â€”â€“
An attacker can access Softaculous via cPanel and manipulate the backup feature to download system files by using a basic directory traversal.
Proof of Concept:
â€”â€”â€”â€”â€”â€“
1. Log into cPanel using a standard account.
2. Open the following URL after the cPanel session:
/frontend/x3/softaculous/index.live.php?act=backups&download=../../../../../../etc/hosts
Note: The length of the directory traversal will depend on where the scripts directory is located. You may have to add additional ../â€™s for this attack to work.
Impact:
â€”â€”-
We have deemed this vulnerability to be rated as LOW due to the fact that Softaculous when accessed via cPanel is done so as the user and thus limits the scope of what files can be downloaded.
Vulnerable Version:
â€”â€”â€”â€”â€”â€”â€“
This vulnerability was tested against Softaculous v4.2.2 for cPanel but is also confirmed to work under InterWorx with some slight changes to the exploit code.
Fixed Version:
â€”â€”â€”â€”â€“
This vulnerability was patched in version v4.2.3.
Vendor Contact Timeline:
â€”â€”â€”â€”â€”â€”â€”â€”
2013-05-03: Vendor contacted via email.
2013-05-04: Vendor confirms vulnerability.
2013-05-06: Vendor issues v4.2.3 update.
2013-05-06: Rack911 issues security advisory.
Click to expand...

Log in or Sign up

Softaculous – Important Security Update Directory Traversal (Root Access)

TiffanyJ.SSS Member

Log in or Sign up

Softaculous – Important Security Update Directory Traversal (Root Access)

TiffanyJ.SSS Member

Useful Searches