Hacker Publishes Alleged Zero-Day Exploit For Plesk 42
hypnosec writes "KingCope, known for many concrete zero-day exploits, has published yet another zero-day through full disclosure – this time for Plesk, a hosting software package made by Parallels and used on thousands of servers across the web. According to KingCope, Plesk versions 9.5.4, 9.3, 9.2, 9.0 and 9.6 on three different Linux variants Red Hat, CentOS and Fedora are vulnerable to the hack. The exploit, as noted by the hacker, makes use of specially crafted HTTP queries that inject PHP commands. The exploit uses POST request to launch a PHP interpreter and the attacker can set any configuration parameters through the POST request. Once invoked, the interpreter can be used to execute arbitrary commands."
little late (Score:5, Informative)
plesk is currently in ver 11... this would have been big like 2 years ago.
Re:little late (Score:5, Insightful)
plesk is currently in ver 11... this would have been big like 2 years ago.
yet, surprisingly, many companies will still be running those Plesk versions due to laziness, stupidity, ignorance, lack of staff for upgrade, etc. See it every day - or a variation of the same - old software kills.
Re: (Score:2)
Now, technically Plesk 11 should still speak the same API dialect we use but since Plesk's API isn't exactly stable as it is I can't rule out that arbitrary parts of it may stop working. Since we can't afford
Re: (Score:2)
Have you ever tried upgrading a Plesk installation? I've done it. Its not pretty. Database inconsistencies, accounts that have to be reinstalled, data loss, they're all very real with this pile of poo software. In fact, when I dealt with it we were more likely to build a new version server and migrate customers to it because upgrading the server in place was so prone to failure. There's a reason there are so many old Plesk versions around. It SUCKS.
Re: (Score:3)
Why not just be a big boy and forgo this hand holding software?
Re: (Score:2)
This "big boy" works in the web hosting business where control panels have been a necessity for a long time. A web hosting company without a control panel won't be around very long. My own web server doesn't need a control panel, and sure I can set up a LAMP stack in my sleep, but I'm not hosting just MY website...
Re: (Score:2)
My company went from Plesk -> cPanel but when we moved to a clustered dual-datacenter hosting environment I found rolling my own control panel surprisingly easy.
The trick is not to make the control panel run as root. Make it write the config to a db and let a shell script write all the config files.
Extremely simple (its just a regular PHP web app) and works really nicely. Even done per account bandwidth monitoring, phpmyadmin, aliases, crons, etc...
Re: (Score:2)
The company I now work for also uses cPanel- its a LOT better.
Re: (Score:2)
Or in the case of one customer I maintain a server for, I thought I would never see them again after the project was completed, and Plesk was the only thing available at the hosting company they insisted on using.
So I configured Plesk so it could only be accessed through the server's private IP address, only opened http and ssh ports on the firewall. So now they can click on one icon to establish a ssh tunnel with https port forwarding to the server's private IP address, then click on a bookmark to open a
Sensationalist Tripe (Score:5, Insightful)
The kiddie is basically claiming Plesk 9.5.4 and prior are vulnerable to CVE-2012-1823. The problem with this is that in order to take advantage of this "new exploit" the distro has to have not had updates applied (this PHP vulnerability was patched some time ago on all the host distros), Plesk has to be configured to run the site as CGI instead of through mod_php, which isn't the default and isn't even possible on many of the claimed versions, and the path claimed isn't even configured on standard Plesk installs. When presented with these facts, his reponse was basically "you lie", so yeah, why is this suddenly news?
Re: (Score:2)
...why is this suddenly news?
Nothing else happening, I suppose
Re:Sensationalist Tripe (Score:5, Interesting)
Try again - Re:Sensationalist Tripe (Score:4, Insightful)
I just patched this on a half dozen servers yesterday - it's not the CVE vulnerability, it's a Plesk-Apache-PHP configuration exploit.
Plesk installed a PHP-via-CGI configuration that turned an entire directory path into an auto-CGI, and exposed the system path to the php executable. A couple of escape characters later and you had remote shell commands executing via POST.
Re: (Score:1)
The configuration of Apache/PHP as described in the exploit, and the attack code itself, is described by CVE-2012-1823.
As the last update for Plesk 9.5.4 came out in April, what exactly was it you thought that you were patching?
Re: (Score:2)
Interesting. I (lazily) tested one of our servers for this vulnerability using the script provided, and it wasn't vulnerable. I only later noticed that our Plesk version is not affected.
Did you test yours before patching?
Re: (Score:1)
If you set it up, why do you have Plesk installed in the first place?
Only 9.0-9.6? (Score:1)
Thank god my hosting provider is till using 8.6.
PHP is a zero-day exploit (Score:1)
PHP running with high privileges is an exploit waiting to happen.
Re: (Score:2)
PHP made me a multi-multi millionare
And your point was again?
what's a multi-multi? you have many millions of many millions?
you're Gates, right? I knew windows had to be done on PHP.
Re: (Score:2, Insightful)
PHP doesn't need high privileges to zombie a box via bots/scripts downloaded to /tmp or /var/tmp in one POST request, and spawned via a second.
Response from Parallels (Score:5, Informative)
Paralells charges to submit security issues (Score:5, Interesting)
Paralells has no one to blame but themselves for this being posted publicly.
Having found exploit code published on Pastebin for Plesk through an automated Google alert, I recently attempted to contact Paralells.
I was unable to do so because I'm not a paying customer willing to pay to submit the security issue.
You can read more about this problem over at my blog. http://caffeinesecurity.blogspot.com/2012/12/how-not-to-handle-software.html [blogspot.com]
werd (Score:2)