Rob Brown has reported a vulnerability in cPanel, which can be exploited by malicious, authenticated users to execute arbitrary code with escalated privileges.

The vulnerability is caused due to a combination of errors in a cPanel patch for suexec when configured with mod_php and certain cPanel perl scripts, which are not taint clean. This can be exploited to execute arbitrary "shared" scripts owned by "root.wheel" with the privileges of an arbitrary user (uid 100 or greater).

Successful exploitation requires that Apache has been compiled without mod_phpsuexec.

The vulnerability has been reported in all cPanel versions (STABLE, RELEASE, CURRENT, and EDGE) up to and including 9.3.0-EDGE_95.

Solution
According to the vendor, this was fixed in version 9.3.0 in June.

Provided and/or discovered by
Rob Brown, A-Squad.

Changelog
Further details available in Customer Area

Original Advisory
http://bugzilla.cpanel.net/show_bug.cgi?id=668

Deep Links
Links available in Customer Area