Re: CVE-2013-2097: zPanel themes remote command execution as root

[Kurt Seifried <kseifried () redhat com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 05/15/2013 07:33 PM, Kurt Seifried wrote:
> So I saw this earlier today:
>
> http://www.reddit.com/r/netsec/comments/1ee0eg/zpanel_support_team_calls_forum_user_fucken/
>
>  and flipped through the forum thread on the zpanel site, but
> didn't have time until now to deal with it. So first off: I saw all
> this stuff and read it before it was removed from the site
> (actually the entire site appears to be down now).
>
> So long and short: you upload a template with the following code:
>
> <& bogus ']; exec("/etc/zpanel/panel/bin/zsudo touch /root/derp"); 
> echo $value['bogus &>
>
> and the command gets executed as root. From googling it appears
> that zPanel won't work with SELinux enabled, which makes sense
> (most web applications fail to ship an SELinux policy, so if they
> need to do strange things outside the default policy they generally
> tell you to simply disable SELinux). So if you run zPanel it would
> be normal to disable SELinux (to make zPanel work), so this root
> level access won't be restricted.
>
> This issue has been assigned CVE-2013-2097.
>
> There is also a mention of a CSRF but I couldn't find any
> additional information on it, if anyone knows about this please
> email me/oss-security with details.

Ok and "joepie91" on reddit posted:

http://www.reddit.com/r/netsec/comments/1ee0eg/zpanel_support_team_calls_forum_user_fucken/c9zujzt

======
It's a pretty basic (and more annoying than harmful) CSRF - basically,
http://zpanel.whatever.com/?logout=anything will log out the user from
a panel, no matter where it's called from. There's no logout key, and
no referer checking.

Insert <img src="http://zpanel.whatever.com/?logout=anything";> on any
site and anyone that visits the page will have their
zpanel.whatever.com session killed instantly.
======

I can't verify this, but even if true it appears that there is no real
trust boundary violation (user clicks the link, they get logged out,
or JavaScript is used to trigger it, whatever). Unless someone can
show otherwise not assigning a CVE for this issue.


- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)

iQIcBAEBAgAGBQJRlSE7AAoJEBYNRVNeJnmT3eIP/iGnhV/LZ7b3a3ssnhqU4ygz
BMjN1QAxapzbDP4UHawqhL6oQRhzwAuPr9N4uwM20Q9+XWoVSCxcK3yZ669+xlNM
QWwK0pboAOaoHMYWjGyjdxkud0l81gCYJG5toHBGYNsRUN26LKY4Bt2JbxuJymhq
0F0WP8QZhaKNzBU+E0A5J1DTmLnkpnKvViOCtG/PmY3o8gLJzAOMnVgmuT9Fqg+5
UyRrGSK8NfLh0WY55knmamiKb4RGyaBlqcmf+9vhUljz9k0WFqQGcM39e5QekrUx
ejcw9CI5s1m0iCwyt6rWo3E7CWrhLGZVdvu9qOjN6W8PiRBxUdV3uE36OAICrxSY
huFU/ojLopf9L3zwBXWBrXWPkwOZZwNcnq4/p9O5yoPA4rFw1Kn7mGp/57+kXmNH
B0oPWmVdOIvC2A2iYer64giV+/gc5Z0lv41eIzuRH0xgrFz2dj6w0ubgMjjFxtjJ
c3/bBGSvHZG6+xxt4D9z++pxYp6aEYs/kJpNp+Fc4Y6PZy5Pp0Hv2u0mGH5CevtG
KEuKAH3tRlpWL9bQ6wuV4KR871zRY84CQ+KiC+dZooPSLZCn/Ng6ARdCkE+ayR0Z
5G+5KNn8YVTs3kbQKgRrhbtplTcykf2nDIcpzro4grBCE+zElu8DAFKP0KcTMsSN
XyeIRmvH6XXyelL+WLq1
=Td1y
-----END PGP SIGNATURE-----