Security: Privilege Escalation via Phusion Passenger's Watchdog API

Situation

A security vulnerability has been discovered in Phusion Passenger's Watchdog API.

Note: This does not affect default installations of cPanel. This vulnerability is only applicable to servers where an affected package has been installed. Please check the "Affected Product Versions" Table for a full list of vulnerable packages.

Affected Product Versions

Impact

Local privilege escalation is possible.

Call to action

Note: CloudLinux engineering is currently preparing and testing patched packages. This page will be updated once those packages are available for CloudLinux systems.

Make sure the Passenger packages are updated to the latest version. The following command can be used to update all packages:

# /scripts/update-packages

Alternatively, the following commands can be used to update those individual packages as needed. These commands will only update packages that are already installed on the server:

If Passenger was installed and reachable on your server before it was patched, the following command can be used to check for signs of compromise:

CPANEL_WARN: Please note that a clean result does not confirm a server was not exploited as these entries are not written at the default log level. Unless the log level has already been raised on your server these would not be recorded.

# grep -E 'API account database is empty|Authentication failed for UID'  /etc/apache2/logs/error_log /usr/local/apache/logs/error_log 2>/dev/null

The log level can be raised if needed to capture any future attempts via the following steps:

1. Log in to WHM as the root user, and access Home / Service Configuration / Apache Configuration / Include Editor

2. Under the Pre Main Include section, select All Versions from the drop-down add the following:

   CONFIG_TEXT: PassengerLogLevel 4

3. Click the Update button to save the configuration, and the Restart Apache button on the next page to restart the service.

How to verify that a server is patched

The following commands can be used to confirm the currently installed version of the Passenger packages:

CentOS/AlmaLinux/CloudLinux

# rpm -q ea-apache24-mod-passenger ea-passenger-src ea-ruby27-rubygem-passenger ea-ruby27-mod_passenger ea-ruby24-rubygem-passenger ea-ruby24-mod_passenger ea-nginx-passenger

Ubuntu

# dpkg-query -W -f='${Package} ${Version}\n' ea-apache24-mod-passenger ea-passenger-src ea-ruby27-rubygem-passenger ea-ruby27-mod_passenger ea-ruby24-rubygem-passenger ea-ruby24-mod_passenger ea-nginx-passenger