Cronjob ln -s symbolic security problem

specialgaming85

• October 03, 2020 13:24

Hello, I configured my server as cPanel, CloudLinux, LiteSpeed, CWAF, CageFS, CXS. All my services are running smoothly. However, I can create a cronjob from one user and access other users' files symbolically. For example, I can read the config.php file in user2's public_html folder by adding a cron to user1 as follows. ln -s /home/user2/public_html/config.php config.txt When cron runs in this way, a shortcut in the form of config.txt occurs on user1. When we view this config.txt file, the contents of the config.php file on user2 appear. This is a very large vulnerability, how can I prevent this? My English is not good. Forgive me. thanks

• 

  CloudLinux Skhristich

  • October 06, 2020 15:03

  Hello, Can you open a support ticket

  0
• 

  LucasRolff

  • October 07, 2020 06:48

  > When we view this config.txt file, the contents of the config.php file on user2 appear As what user are you viewing this file? as user1 or as root?

  0

Please sign in to leave a comment.