full-disclosure - cPanel Malicious HTML Tags Injection Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <3F07E1F4.5090202@sanctuminc.com>
From: ory.segal at sanctuminc.com (Ory Segal)
Subject: cPanel Malicious HTML Tags Injection Vulnerability

-------------------------------------------------------------------------------
-----[ cPanel Malicious HTML Tags Injection Vulnerability
-------------------------------------------------------------------------------

--[ Author: Ory Segal, Sanctum inc. http://www.SanctumInc.com
--[ Discovery Date: 06/17/2003 (Vendor was notified)
--[ Release Date: 07/06/2003
--[ Product: Tested on cPanel 6.4.2-STABLE
--[ Severity: Medium
--[ CVE: Not assigned yet

--[ Summary

 From the vendor's web site:
"...The Cpanel interface is a client side interface, which allows your 
customers
to easily control a web hosting account. With the touch of a button, 
they can
add e-mail accounts, access their files, backup their files, setup a 
shopping
cart, and more..."

Web users can embed Malicious HTML tags in HTTP requests, which will later
be parsed by the web site administrator's browser, in several cPanel 
screens.
This may lead to theft of cookies associated with the domain, or 
execution of
client-side scripts in the administrator's browser.

--[ Description

The 'Error Log' and 'Latest Visitors' screens in cPanel, provide the web 
site
administrator with HTTP request logs. These scripts do not sanitize the 
URL part
of HTTP requests and present them to the administrator as is, thus, 
allowing an
attacker to embed malicious HTML tags that will later be parsed and 
executed by
the administrators browser.

For example, lets take a look at the 'Error Log' screen:

[From errlog.html]
...
<b>Last 300 Error Log Messages in reverse order:</b><hr>
<pre>
[Tue Jun 17 08:41:14 2003] [error] [client x.x.x.x] File does not exist:
/home/dir/public_html/foobar.html
</pre>
...

The following request will present a pop-up screen with the cookies
that are currently associated with the domain:

  GET /<script>alert(document.cookie);</script> HTTP/1.0
  Host: www.site.com

--[ Note

The 'Latest Visitors' screen of the tested version (6.4.2-STABLE) 
presented the
latest requests as HTML links, thus the malicious payload must terminate 
the <a>
tag before opening a new one. For example:

  GET /"></a><script>alert(document.cookie);</script> HTTP/1.0
  Host: www.site.com

--[ Solution

According to the vendor, the problem was fixed in version 7.0, which can be
downloaded at: http://www.cpanel.net/downloads.htm