cPanel TSR-2015-0002 Full Disclosure

cPanel TSR-2015-0002 Full Disclosure SEC-2 Summary Multiple vulnerabilities via ExpVar overexpansion. Security Rating cPanel has assigned this vulnerability a CVSSv2 score of 6.4 [plain](AV:N/AC:L/Au:N/C:P/I:P/A:N)[/plain] Description The WHM, cPanel, and Webmail interfaces use a common routine named "expvar" for interpolating user input and some cPanel template variables. In many interfaces, this function could be tricked into over interpolating user-supplied inputs to bypass context specific escaping or execute arbitrary code across privilege boundaries. Credits This issue was discovered by the cPanel Security Team. Solution This issue is resolved in the following builds: 11.48.1.3 11.46.3.1 11.44.3.1 SEC-3 Summary Arbitrary code execution via secondary ExpVar expansion in API2 engine. Security Rating cPanel has assigned this vulnerability a CVSSv2 score of 6.4 [plain](AV:N/AC:L/Au:N/C:P/I:P/A:N)[/plain] Description The WHM, cPanel, and Webmail interfaces use a common routine named "expvar" for interpolating user input and some cPanel template variables. In the cPanel API2 templating and tag engine, this function was called on tainted data returned from API2 calls which allowed the execution of arbitrary code across privilege boundaries. Credits This issue was discovered by the cPanel Security Team. Solution This issue is resolved in the following builds: 11.48.1.3 11.46.3.1 11.44.3.1 SEC-6 Summary Security token disclosed during xfer logins. Security Rating cPanel has assigned this vulnerability a CVSSv2 score of 4.0 [plain](AV:N/AC:L/Au:S/C:P/I:N/A:N)[/plain] Description When doing an xfer login from WHM to cPanel or from cPanel to a webmail virtual user, the security token was disclosed to the lesser privileged user. This allowed possible XSRF attacks into the higher privileged interface. Credits This issue was discovered by the cPanel Security Team. Solution This issue is resolved in the following builds: 11.48.1.3 11.46.3.1 11.44.3.1 SEC-9 Summary Limited path traversal and configuration leak in Mailman Cache Regeneration. Security Rating cPanel has assigned this vulnerability a CVSSv2 score of 2.1 [plain](AV:N/AC:H/Au:S/C:P/I:N/A:N)[/plain] Description When regenerating the Mailman mailing list configuration cache for a user, a list of mailing list names is provided. These mailing list names were not checked for validity or ownership. This allowed an attacker to test for the existence of files on the system or display a limited set of configuration keys for arbitrary mailing lists. Credits This issue was discovered by the cPanel Security Team. Solution This issue is resolved in the following builds: 11.48.1.3 11.46.3.1 11.44.3.1 SEC-10 Summary Format string vulnerability in maketext API1 function. Security Rating cPanel has assigned this vulnerability a CVSSv2 score of 4.9 [plain](AV:N/AC:M/Au:S/C:P/I:P/A:N)[/plain] Description cPanel & WHM uses the Locale::Maketext Perl library to provide translations for users. Locale::Maketext is vulnerable to string attacks if an untrusted user is allowed to provide the maketext format string. cPanel and Webmail accounts were allowed to call this function directly using remote API1 commands. With specially crafted format strings, this allowed webmail virtual accounts to run arbitrary code with the effective UID and GID of the cPanel account that owned the virtual account. Credits This issue was discovered by the cPanel Security Team. Solution This issue is resolved in the following builds: 11.48.1.3 11.46.3.1 11.44.3.1 SEC-12 Summary Limited arbitrary file chmod in cpsrvd. Security Rating cPanel has assigned this vulnerability a CVSSv2 score of 3.5 [plain](AV:N/AC:M/Au:S/C:N/I:P/A:N)[/plain] Description There was a race condition during a chmod call after a UID/GID switch to the app user. This allowed an authenticated attacker to chmod arbitrary files on the server using the privileges of the app user. Credits This issue was discovered by the cPanel Security Team. Solution This issue is resolved in the following builds: 11.48.1.3 11.46.3.1 11.44.3.1 SEC-13 Summary Convertmaildir script reveals contents of arbitrary directories. Security Rating cPanel has assigned this vulnerability a CVSSv2 score of 2.1 [plain](AV:N/AC:H/Au:S/C:P/I:N/A:N)[/plain] Description When converting from an mbox-file type email account, the convertmaildir script reads the content of a user's ~/mail directory. This directory read was performed as root. By creating a symlink to another directory, the script could be tricked into revealing the file names contained within the target location. Credits This issue was discovered by the cPanel Security Team. Solution This issue is resolved in the following builds: 11.48.1.3 11.46.3.1 11.44.3.1 SEC-15 Summary Stored XSS in /frontend/x3/stats/lastvisit_legacy.html. Security Rating cPanel has assigned this vulnerability a CVSSv2 score of 4.3 [plain](AV:N/AC:M/Au:N/C:N/I:P/A:N)[/plain] Description The "Legacy" Latest-Visitors page in X3 includes generated links to the referring URIs of website visitors. An attacker could insert values into the referrer string that would cause arbitrary javascript to run when the links were clicked. Credits This issue was discovered by Mateusz Goik. Solution This issue is resolved in the following builds: 11.48.1.3 11.46.3.1 11.44.3.1 SEC-16 Summary Stored XSS in /cgi-sys/guestbook.cgi. Security Rating cPanel has assigned this vulnerability a CVSSv2 score of 4.3 [plain](AV:N/AC:M/Au:N/C:N/I:P/A:N)[/plain] Description The cPanel Guestbook allows visitors to include a link-back URL on submitted entries. An attacker could insert arbitrary Javascript into this URL, which would run when clicked by other visitors to the guestbook. Credits This issue was discovered by Mateusz Goik. Solution This issue is resolved in the following builds: 11.48.1.3 11.46.3.1 11.44.3.1 SEC-17 Summary Arbitrary code execution via ExpVar expansion in UI_finishaction API1 command. Security Rating cPanel has assigned this vulnerability a CVSSv2 score of 3.6 [plain](AV:N/AC:H/Au:S/C:P/I:P/A:N)[/plain] Description The WHM, cPanel, and Webmail interfaces use a common routine named "expvar" for interpolating user input and some cPanel template variables. In the cPanel UI_finishaction API1 call, the function was called on tainted data provided by the cPanel user allowing the execution of arbitrary code that could bypass demo or jailshell account restrictions. Credits This issue was discovered by the cPanel Security Team. Solution This issue is resolved in the following builds: 11.48.1.3 11.46.3.1 11.44.3.1 SEC-18 Summary Self-XSS vulnerability in /backend/mailappsetup.cgi. Security Rating cPanel has assigned this vulnerability a CVSSv2 score of 2.1 [plain](AV:N/AC:H/Au:S/C:N/I:P/A:N)[/plain] Description The mailappsetup.cgi script generates a ZIP file containing a user's configuration data for Mail.app. The name of this ZIP file is generated based upon query parameters passed to the script. These parameters were not sufficiently sanitized. An attacker could use these parameters to conduct an HTTP response splitting attack to inject arbitrary HTTP headers and HTML content into the response returned by the server. Credits This issue was discovered by Mateusz Goik. Solution This issue is resolved in the following builds: 11.48.1.3 11.46.3.1 11.44.3.1 SEC-19 Summary Self-XSS in multiple interfaces via QUERY_STRING. Security Rating cPanel has assigned this vulnerability a CVSSv2 score of 2.1 [plain](AV:N/AC:H/Au:S/C:N/I:P/A:N)[/plain] Description Multiple interfaces within cPanel and WHM reflected the raw QUERY_STRING back to the browser. This raw QUERY_STRING was not processed or encoded beyond the URI encoding performed by the browser itself. Some browsers encode only a limited set of characters in query strings, allowing unsafe javascript to be injected into the rendered page. Credits This issue was discovered by the cPanel Security Team. Solution This issue is resolved in the following builds: 11.48.1.3 11.46.3.1 11.44.3.1 SEC-20 Summary Arbitrary code execution for webmail accounts via printhelp API1 command. Security Rating cPanel has assigned this vulnerability a CVSSv2 score of 4.0 [plain](AV:N/AC:L/Au:S/C:P/I:N/A:N)[/plain] Description The printhelp API1 function expanded arguments passed to it with ExpVar twice. By passing a carefully crafted request to a webmail page utilizing this function, a webmail virtual account could execute arbitrary code as the cPanel user. Credits This issue was discovered by the cPanel Security Team. Solution This issue is resolved in the following builds: 11.48.1.3 11.46.3.1 11.44.3.1 SEC-21 Summary Reflected XSS vulnerability in /whm, /cpanel, and /webmail redirects. Security Rating cPanel has assigned this vulnerability a CVSSv2 score of 4.3 [plain](AV:N/AC:M/Au:N/C:N/I:P/A:N)[/plain] Description The standard redirects from Apache into cPanel & WHM services retain portions of the URI provided by the user. This data was not correctly escaped for rendering into a javascript string, allowing unsafe javascript to be injected into the rendered page for some browsers. Credits This issue was discovered by Trustwave. Solution This issue is resolved in the following builds: 11.48.1.3 The PGP-Signed message can be read here: