[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <51943770.6010001@redhat.com>
Date: Wed, 15 May 2013 19:33:36 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: Open Source Security <oss-security@...ts.openwall.com>
Subject: CVE-2013-2097: zPanel themes remote command execution as root
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
So I saw this earlier today:
http://www.reddit.com/r/netsec/comments/1ee0eg/zpanel_support_team_calls_forum_user_fucken/
and flipped through the forum thread on the zpanel site, but didn't
have time until now to deal with it. So first off: I saw all this
stuff and read it before it was removed from the site (actually the
entire site appears to be down now).
So long and short: you upload a template with the following code:
<& bogus ']; exec("/etc/zpanel/panel/bin/zsudo touch /root/derp");
echo $value['bogus &>
and the command gets executed as root. From googling it appears that
zPanel won't work with SELinux enabled, which makes sense (most web
applications fail to ship an SELinux policy, so if they need to do
strange things outside the default policy they generally tell you to
simply disable SELinux). So if you run zPanel it would be normal to
disable SELinux (to make zPanel work), so this root level access won't
be restricted.
This issue has been assigned CVE-2013-2097.
There is also a mention of a CSRF but I couldn't find any additional
information on it, if anyone knows about this please email
me/oss-security with details.
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
iQIcBAEBAgAGBQJRlDdwAAoJEBYNRVNeJnmTp6oQAJLBXZOkw5nhXRQDQ87mJWUh
n+R5fEOGktbAzZMMAYlAaj5UaHlOsMBh9zOyEXDNFWFKFkh8vNOzoAA0famjbyCG
qpGyXoBJlDEntFLU0W5Z+cEClzMo1Y1eIOYXczRhKpPsgbhwou97HZrg6eIv2SWk
38sD8nJjKID1wqfWCy0jtjoZ9DKSGviU5t/lPH78sftOTw6BxV3g7pvSKffKnVA4
2A8sqCPLhW3ZxTvSPUXLK2SK6r8SaOR+hV4yxNJSAO6QMwPLPE71M54KAatqwzi8
uWYrO1SLQtUK9TbTXUg7acd9x5o5eFMfNIVvyyfmbD4j+vLoaM7y1rSjWwDUGL3p
lFrsxxe3EFg7cYunf4dz5pi/0JBNhbfs5vSs0vYTWAtUdkGs8ygU4DSyAkTV7+sI
h5pMPP1NBGIdEqQIS/Jlbu11v/pXJG0ZBtwDTDmID9jnxletITvtE201rfZ/V9Jh
61NEtPhXso50K9hJF560hzXsyDXPxhpFpwGo71NkMxfOIrP/0QFClitLV6aRRPlu
Zep9OAZYxrMc77H+daTumF7Wie4wxSHuQF/V51YeD9aY40gQRLwBeAJirkw6IxJI
yX1zFWa5Du1l1/B/sQtMWOjfRONeY4lk153E3penDzzcfpJO1hJ5BvZIxFpXLFdT
KsvJPzXsHEzGA/G7wNMV
=K5om
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
