Vulnerability Note VU#584089

cPanel XSRF vulnerabilities

Overview

cPanel contains multiple cross-site request forgery (XSRF) vulnerabilities. If successfully exploited, these vulnerabilities may allow an attacker to execute arbitrary commands.

I. Description

cPanel, a web-based tool that is designed to automate and control web sites and servers, contains multiple cross-site request forgery (XSRF) vulnerabilities. These vulnerabilities may be triggered by a remote attacker who convinces an administrator to browse to a malicious website while logged into their cPanel account.

II. Impact

An attacker may be able to perform actions that only authorized administrators should be able to execute.

III. Solution

We are currently unaware of a practical solution to this problem.

Enable referrer checking

Referrer checking may mitigate some XSRF attacks. To enable referrer checking, follow the steps below. Note that referrer checking may cause some applications to fail.

Navigate to Server configuration
Go to Tweak Settings
Go to Security in WebHost Manager
Check the box and save the page

Do not browse to untrusted sites

Administrators can mitigate XSRF vulnerabilities in cPanel and other browser-based tools by not browsing to untrusted websites while logged into their account.

Systems Affected

Vendor	Status	Date Updated
cPanel Inc.	Vulnerable	28-Apr-2008

References

http://www.rooksecurity.com/blog/?p=7
http://changelog.cpanel.net/
http://www.owasp.org/index.php/Cross-Site_Request_Forgery
http://en.wikipedia.org/wiki/XSRF
http://secunia.com/advisories/30027/

Credit

Thanks to Michael Brooks for information that was used in this report.

This document was written by Ryan Giobbi.

Other Information

Date Public	04/17/2008
Date First Published	04/30/2008 03:47:27 PM
Date Last Updated	07/30/2008
CERT Advisory
CVE Name	CVE-2008-2043
Metric	2.25
Document Revision	21

If you have feedback, comments, or additional information about this vulnerability, please send us email.