SECUNIA ADVISORY ID: SA33990

VERIFY ADVISORY: http://secunia.com/advisories/33990/

DESCRIPTION: mckt has reported some vulnerabilities in cPanel, which can be exploited by malicious, local users to conduct script insertion attacks and by malicious people to conduct cross-site scripting attacks. Successful exploitation of these cross-site request forgery vulnerabilities requires that the "XSRF protection" within the WHM's Tweak Settings under the Security section is disabled.



1) Input via the ".contactemail" file in a user's home directory is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code in a user's browser session in context of an affected site if a malicious email is displayed.
2) Input via the URL to the "scripts2/confdkillproc" script is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Note: Additionally, the application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to e.g. change passwords or install other software versions by tricking the user into visiting a malicious web site.

SOLUTION: Fixed in the Edge and Current builds version 11.24.4 and 11.24.7 with a build ID greater than 34195 - http://layer2.cpanel.net/ - Reportedly, this will be fixed in all public builds soon.

PROVIDED AND/OR DISCOVERED BY: mckt

ORIGINAL ADVISORY:
1) http://skeptikal.org/index.php?entry=entry080805-140000
2) http://skeptikal.org/index.php?entry=entry080809-180834