Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm managing an Apache Server (Centos 5.6 + cPanel) and I found a code that lists all user accounts hosted in the server.

I want to know if there is something that I should change in the Apache configuration to prevent users from doing that.

This is the .htaccess code :

Options FollowSymLinks MultiViews Indexes ExecCGI

AddType application/x-httpd-cgi .pl

AddHandler cgi-script .pl
AddHandler cgi-script .pl

And the .pl code :

open (d0mains, '/etc/named.conf') or $err=1;
@kr = ;
close d0mains;
if ($err){
print (' 

C0uldn\'t Bypass it , Sorry

'); die(); }else{ print ' 

H3r3 !s 411 D0m4!ns & Us3rs :

';} foreach my $one (@kr) { if($one =~ m/.*?zone "(.*?)" {/){ $filename= "/etc/valiases/".$1; $owner = getpwuid((stat($filename))[4]); print ''.$1.' : '.$owner.'

'; } }
share|improve this question
add comment

2 Answers

Well, you can modify your Apache configuration to prevent users from running dynamic content; that'll fix the problem at the expense of basically knobbling your server for most forms of hosting. On the other hand, you could extensively modify the way that dynamic content is run (including chrooting) to prevent this problem, but that'll be a lot of work (and it's highly technical and prone to lengthy outages if you don't know what you're doing).

Honestly, I'd be taking it up with cPanel. It's their information disclosure vulnerability, and you're paying them to look after you.

share|improve this answer
add comment

Actually, the users are not suppose to read anything from outside their document root and if they can, then your server has serious security flaw. If the script was invoked using apache, you can disable FollowSymLinks & can enable SymLinksIfOwnerMatch for / to prevent this from happening. You can do this from WHM >> Service Configuration >> Apache Configuration >> Global Configuration (under Directory ‘/’ Options). Also ask your host to tighten your server security to prevent any future attacks.

http://docs.cpanel.net/twiki/bin/view/AllDocumentation/WHMDocs/GlobalConfig

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.