Web Hosting Talk : Web Hosting Main Forums : Hosting Security and Technology : cPanel critical vulnerability

[phiber_9]

A vulnerability was discovered in the File Manager of cPanel WysiwygPro editor.
Any file hosted on a cPanel server with File Manager editor can be edited without any authorization.

[edited]

[3spades]

Workaround
By running: "chmod 000 /usr/local/cpanel/3rdparty/WysiwygPro" the WysiwygPro editor is disabled.

There, now they dont need to go to your site and view your ads to get the fix.

[andren]

Originally Posted by phiber_9

A vulnerability was discovered in the File Manager of cPanel WysiwygPro editor.
Any file hosted on a cPanel server with File Manager editor can be edited without any authorization.

[edited]

Hm. pretty late announcement for a security company, don't you think?
It is several days old.

[WireNine]

Maybe cpanel will release an update soon to fix this.

[phiber_9]

Originally Posted by andren

Hm. pretty late announcement for a security company, don't you think?

No. Why?
Posting this vulnerability would point blackhats where to look.
Also, it would be blackhat by itself not to get at least some kind of feedback from cPanel staff, possible official-workarounds and etc.

Originally Posted by WN-Ali

Maybe cpanel will release an update soon to fix this.

It's already fixed in latest EDGE, however I wouldn't advise running EDGE on production servers.