Prevent users from listing Apache server accounts

Question

I'm managing an Apache Server (Centos 5.6 + cPanel) and I found a code that lists all user accounts hosted in the server.

I want to know if there is something that I should change in the Apache configuration to prevent users from doing that.

This is the .htaccess code :

Options FollowSymLinks MultiViews Indexes ExecCGI

AddType application/x-httpd-cgi .pl

AddHandler cgi-script .pl
AddHandler cgi-script .pl

And the .pl code :

open (d0mains, '/etc/named.conf') or $err=1;
@kr = ;
close d0mains;
if ($err){
print (' 
C0uldn\'t Bypass it , Sorry
');
die();
}else{
print ' 

H3r3 !s 411 D0m4!ns & Us3rs :

';}
foreach my $one (@kr)
{
if($one =~ m/.*?zone "(.*?)" {/){
$filename= "/etc/valiases/".$1;
$owner = getpwuid((stat($filename))[4]);
print ''.$1.' : '.$owner.'

';
}
}

Answer 1

Well, you can modify your Apache configuration to prevent users from running dynamic content; that'll fix the problem at the expense of basically knobbling your server for most forms of hosting. On the other hand, you could extensively modify the way that dynamic content is run (including chrooting) to prevent this problem, but that'll be a lot of work (and it's highly technical and prone to lengthy outages if you don't know what you're doing).

Honestly, I'd be taking it up with cPanel. It's their information disclosure vulnerability, and you're paying them to look after you.

Answer 2

Actually, the users are not suppose to read anything from outside their document root and if they can, then your server has serious security flaw. If the script was invoked using apache, you can disable FollowSymLinks & can enable SymLinksIfOwnerMatch for / to prevent this from happening. You can do this from WHM >> Service Configuration >> Apache Configuration >> Global Configuration (under Directory ‘/’ Options). Also ask your host to tighten your server security to prevent any future attacks.

http://docs.cpanel.net/twiki/bin/view/AllDocumentation/WHMDocs/GlobalConfig