cPanel 11.38.2/11.40.1/11.42.0 trackupload HTTP Request symlink
CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
4.9 | $0-$5k | 0.00 |
A vulnerability classified as problematic was found in cPanel 11.38.2/11.40.1/11.42.0 (Hosting Control Software). Affected by this vulnerability is an unknown part of the component trackupload. The manipulation as part of a HTTP Request leads to a symlink vulnerability. The CWE definition for the vulnerability is CWE-61. The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files. As an impact it is known to affect integrity, and availability.
The weakness was shared 03/31/2014 by Rack911 with cPanel Security Team as TSR 2014-0003 as confirmed advisory (Website). It is possible to read the advisory at cpanel.net. The vendor cooperated in the coordination of the public release. Attacking locally is a requirement. The exploitation doesn't need any form of authentication. Technical details are unknown but an exploit is available. The advisory points out:
The trackupload functionality in cPanel & WHM’s default POST parameter and QUERY_STRING processor module allows a log file to be written and queried while a file upload is occurring. In some contexts, an authenticated attacker could make cpsrvd create the trackupload log file inside the user’s home directory while running with the effective UID of root. By combining this with a symlinked trackupload log file target, any file on the system could be overwritten.
It is declared as highly functional.
Upgrading to version 11.42.0.23, 11.40.1.13 or 11.38.2.23 eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.
The vulnerability is also documented in the vulnerability database at X-Force (92245). The entries 12792, 12793, 12794 and 12795 are related to this item.
Product
Type
Name
Version
License
CPE 2.3
CPE 2.2
CVSSv4
VulDB CVSS-B Score: 🔍VulDB CVSS-BT Score: 🔍
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 5.1VulDB Meta Temp Score: 4.9
VulDB Base Score: 5.1
VulDB Temp Score: 4.9
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
Exploiting
Class: SymlinkCWE: CWE-61 / CWE-59
ATT&CK: Unknown
Local: Yes
Remote: No
Availability: 🔍
Status: Highly functional
Price Prediction: 🔍
Current Price Estimation: 🔍
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
Reaction Time: 🔍
0-Day Time: 🔍
Exposure Time: 🔍
Upgrade: cPanel 11.42.0.23/11.40.1.13/11.38.2.23
Timeline
03/31/2014 🔍03/31/2014 🔍
04/01/2014 🔍
04/01/2014 🔍
04/04/2014 🔍
03/31/2019 🔍
Sources
Advisory: TSR 2014-0003Researcher: Rack911
Organization: cPanel Security Team
Status: Confirmed
Coordinated: 🔍
X-Force: 92245 - cPanel trackupload functionality symlink, Medium Risk
SecurityFocus: 66561 - cPanel Multiple Security Vulnerabilities
Secunia: 57576 - cPanel Multiple Vulnerabilities, Moderately Critical
scip Labs: https://www.scip.ch/en/?labs.20161013
See also: 🔍
Entry
Created: 04/04/2014 10:29Updated: 03/31/2019 22:53
Changes: 04/04/2014 10:29 (48), 03/31/2019 22:53 (13)
Complete: 🔍
No comments yet. Languages: en.
Please log in to comment.