Type: Arbitrary File Access
Vulnerable Version: All versions prior to the fixed builds below.
Fixed Version: 184.108.40.206, 220.127.116.11, 18.104.22.168 & 22.214.171.124
cPanel is an easy-to-use control panel that gives web hosts and the website owners they serve, the ability to quickly and easily manage their servers and websites. Web Host Manager (WHM) is a part of the cPanel software, often used by resellers and system administrators.
It is possible for a malicious user to obtain the contents of any file on a cPanel server, including sensitive root files, by modifying the user valias to include a carefully crafted string which can then be accessed via a specific email request.
We have deemed this vulnerability to be rated as HIGH due to the fact that a user can access any file on the server with minimal effort.
This vulnerability was tested against cPanel 126.96.36.199 and is believed to exist in all versions prior to the fixed builds below.
This vulnerability was patched in cPanel 188.8.131.52, 184.108.40.206, 220.127.116.11 & 18.104.22.168.
Vendor Contact Timeline:
2014-06-22: Vendor contacted via email.
2014-06-22: Vendor confirms vulnerability.
2014-07-21: Vendor issues updates to all builds.
2014-07-28: RACK911 issues security advisory.