Categories: Security

CloudFlare (cPanel Plugin) v5.3.2 symlink attack vulnerability !

 

Type: Symlink Attack
Location: Local
Impact: High
Product: CloudFlare (cPanel Plugin)
Website: http://www.cloudflare.com
Vulnerable Version: 5.3.2
Fixed Version: 5.3.11
CVE: -
R911: 0187
Date: 2016-01-15

 

Product Description:

CloudFlare protects and accelerates any website online. Once your website is a part of the CloudFlare community, its web traffic is routed through our intelligent global network. We automatically optimize the delivery of your web pages so your visitors get the fastest page load times and best performance. We also block threats and limit abusive bots and crawlers from wasting your bandwidth and server resources. The result: CloudFlare-powered websites see a significant improvement in performance and a decrease in spam and other attacks.
Vulnerability Description:

Due to a carefully timed symlink attack directed at the cloudflare_data.yaml file, it is possible for a malicious user to change the permissions on any root owned file to 600 which could lead to the OS being disabled.

Impact:

We have deemed this vulnerability to be rated as HIGH due to the fact that should the malicious user target certain system files, such as /etc/passwd, it could render the OS inoperable.
Vulnerable Version:

This vulnerability was tested against CloudFlare (cPanel Plugin) v5.3.2 and is believed to exist in all prior versions.
Fixed Version:

This vulnerability was patched CloudFlare (cPanel Plugin) v5.3.11.
Vendor Contact Timeline:

2016-01-13: Vendor contacted via HackerOne.

2016-01-13: Vendor confirms vulnerability.

2016-01-14: Vendor issues update.

2016-01-15: RACK911 Labs issues security advisory.

 

 

How to Check the Latest Version of  Cloudflare cPanel Plugin on Server

cat /usr/local/cpanel/etc/cloudflare.json | grep version

 

To Update the Cloudflare version

/usr/local/cpanel/bin/cloudflare_update.sh force

 

Soure : RACK911 Labs

 

 


Vishwajit Kale
Vishwajit Kale blazed onto the digital marketing scene back in 2015 and is the digital marketing strategist of Hostripples, a company that aims to provide affordable web hosting solutions. Vishwajit is experienced in digital and content marketing along with SEO. He's fond of writing technology blogs, traveling and reading.

Recent Posts

The Ultimate Showdown: Linux vs Windows for VPS Hosting

As the demand for virtual private servers (VPS) continues to grow, businesses and individuals are faced with a crucial decision:…

2 weeks ago

Questions to Ask Your Web Hosting Support Team

Web hosting is a large industry, as many other factors help any web hosting provider to form a company. The…

2 weeks ago

How to Secure Your WordPress Site in 2025

Welcome to the complete guide to WordPress security best practices in 2024. As technology evolves rapidly, implementing strong security measures…

3 weeks ago

Unlocking the Secrets of Hosting: Essential Questions to Ask Hostripples

Hey, wanted to learn about web hosting? Or do you want to start a new website and need hosting? Questions…

3 weeks ago

DDoS Attacks: What You Need to Know for Protection

In today's digital world, the threat of DDoS attacks has become increasingly prevalent. These types of attacks have the power…

1 month ago