Slashdot Mirror

← Back to Stories (view on slashdot.org)

Hacker Publishes Alleged Zero-Day Exploit For Plesk

Posted by timothy on from the head-plesk dept.

hypnosec writes "KingCope, known for many concrete zero-day exploits, has published yet another zero-day through full disclosure – this time for Plesk, a hosting software package made by Parallels and used on thousands of servers across the web. According to KingCope, Plesk versions 9.5.4, 9.3, 9.2, 9.0 and 9.6 on three different Linux variants Red Hat, CentOS and Fedora are vulnerable to the hack. The exploit, as noted by the hacker, makes use of specially crafted HTTP queries that inject PHP commands. The exploit uses POST request to launch a PHP interpreter and the attacker can set any configuration parameters through the POST request. Once invoked, the interpreter can be used to execute arbitrary commands."

22 of 42 comments (clear)

  1. little late by Anonymous Coward · · Score: 5, Informative

    plesk is currently in ver 11... this would have been big like 2 years ago.

    1. Re:little late by Anonymous Coward · · Score: 5, Insightful

      plesk is currently in ver 11... this would have been big like 2 years ago.

      yet, surprisingly, many companies will still be running those Plesk versions due to laziness, stupidity, ignorance, lack of staff for upgrade, etc. See it every day - or a variation of the same - old software kills.

    2. Re:little late by toygeek · · Score: 1

      Have you ever tried upgrading a Plesk installation? I've done it. Its not pretty. Database inconsistencies, accounts that have to be reinstalled, data loss, they're all very real with this pile of poo software. In fact, when I dealt with it we were more likely to build a new version server and migrate customers to it because upgrading the server in place was so prone to failure. There's a reason there are so many old Plesk versions around. It SUCKS.

      --
      Nobodies Prefect
      Tidbits for Techs Technology Blog
    3. Re:little late by h4rr4r · · Score: 2

      Why not just be a big boy and forgo this hand holding software?

    4. Re:little late by toygeek · · Score: 1

      This "big boy" works in the web hosting business where control panels have been a necessity for a long time. A web hosting company without a control panel won't be around very long. My own web server doesn't need a control panel, and sure I can set up a LAMP stack in my sleep, but I'm not hosting just MY website...

      --
      Nobodies Prefect
      Tidbits for Techs Technology Blog
    5. Re:little late by cheater512 · · Score: 1

      My company went from Plesk -> cPanel but when we moved to a clustered dual-datacenter hosting environment I found rolling my own control panel surprisingly easy.

      The trick is not to make the control panel run as root. Make it write the config to a db and let a shell script write all the config files.
      Extremely simple (its just a regular PHP web app) and works really nicely. Even done per account bandwidth monitoring, phpmyadmin, aliases, crons, etc...

    6. Re:little late by toygeek · · Score: 1

      The company I now work for also uses cPanel- its a LOT better.

      --
      Nobodies Prefect
      Tidbits for Techs Technology Blog
    7. Re:little late by t4ng* · · Score: 1

      Or in the case of one customer I maintain a server for, I thought I would never see them again after the project was completed, and Plesk was the only thing available at the hosting company they insisted on using.

      So I configured Plesk so it could only be accessed through the server's private IP address, only opened http and ssh ports on the firewall. So now they can click on one icon to establish a ssh tunnel with https port forwarding to the server's private IP address, then click on a bookmark to open a browser that connects them to the Plesk control panel.

      So I don't really care if there is a Plesk exploit, it's never available on a public connection.

    8. Re:little late by Jesus_666 · · Score: 1

      At my workplace we still use Plesk 9.5. This is because we decided to go with a hosted server instead of one where we actually have any control and that's what the server came with. Since we're dependent on the Plesk API working we've been putting off a proposed update to Plesk 11 for a some time now.

      Now, technically Plesk 11 should still speak the same API dialect we use but since Plesk's API isn't exactly stable as it is I can't rule out that arbitrary parts of it may stop working. Since we can't afford to have everyone on standby to catch possible business-breaking Plesk bugs right now we're putting it off until after our current development project.

      Of course the proper solution would be to switch to a management console with a more reasonable XML-RPC implementation or to just configure the involved programs directy. Unfortunately we can do neither. (And yes, configuring a dozen different software packages by hand would be easier than dealing with Plesk's API. At least in 9.5 that API is so damn unreliable that I have to go clean up after it at least once a week.)

      --
      USE HOT GRITS WITH STATUE OF NATALIE PORTMAN (NAKED AND PETRIFIED)
  2. Sensationalist Tripe by Anonymous Coward · · Score: 5, Insightful

    The kiddie is basically claiming Plesk 9.5.4 and prior are vulnerable to CVE-2012-1823. The problem with this is that in order to take advantage of this "new exploit" the distro has to have not had updates applied (this PHP vulnerability was patched some time ago on all the host distros), Plesk has to be configured to run the site as CGI instead of through mod_php, which isn't the default and isn't even possible on many of the claimed versions, and the path claimed isn't even configured on standard Plesk installs. When presented with these facts, his reponse was basically "you lie", so yeah, why is this suddenly news?

    1. Re:Sensationalist Tripe by fustakrakich · · Score: 2

      ...why is this suddenly news?

      Nothing else happening, I suppose

      --
      “He’s not deformed, he’s just drunk!”
    2. Re:Sensationalist Tripe by Zapotek · · Score: 4, Interesting

      The dude replied to a valid and well-thought-out question with (irrelevant) lyrics from a Greek song. I wouldn't trust him to fill a glass of water, he obviously just wants some attention.

  3. Only 9.0-9.6? by Anonymous Coward · · Score: 1

    Thank god my hosting provider is till using 8.6.

  4. Re:So what? I hate Plesk anyways. by Anonymous Coward · · Score: 1

    If you set it up, why do you have Plesk installed in the first place?

  5. Try again - Re:Sensationalist Tripe by TBone · · Score: 3, Insightful

    I just patched this on a half dozen servers yesterday - it's not the CVE vulnerability, it's a Plesk-Apache-PHP configuration exploit.

    Plesk installed a PHP-via-CGI configuration that turned an entire directory path into an auto-CGI, and exposed the system path to the php executable. A couple of escape characters later and you had remote shell commands executing via POST.

    --

    This space for rent. Call 1-800-STEAK4U

    1. Re:Try again - Re:Sensationalist Tripe by Anonymous Coward · · Score: 1

      The configuration of Apache/PHP as described in the exploit, and the attack code itself, is described by CVE-2012-1823.
      As the last update for Plesk 9.5.4 came out in April, what exactly was it you thought that you were patching?

    2. Re:Try again - Re:Sensationalist Tripe by ameen.ross · · Score: 1

      Interesting. I (lazily) tested one of our servers for this vulnerability using the script provided, and it wasn't vulnerable. I only later noticed that our Plesk version is not affected.
      Did you test yours before patching?

      --
      $(echo cm0gLXJmIC8= | base64 --decode)
  6. Re:PHP is a zero-day exploit by TBone · · Score: 1, Insightful

    PHP doesn't need high privileges to zombie a box via bots/scripts downloaded to /tmp or /var/tmp in one POST request, and spawned via a second.

    --

    This space for rent. Call 1-800-STEAK4U

  7. Response from Parallels by Parallels · · Score: 5, Informative

    This vulnerability is a variation of the long known CVE-2012-1823 vulnerability related to the CGI mode of PHP only in older Plesks. All currently supported versions of Parallels Plesk Panel 9.5, 10.x and 11.x, as well Parallels Plesk Automation, are not vulnerable. If a customer is using legacy, and a no longer supported version of Parallels Plesk Panel, they should upgrade to the latest version. For the legacy versions of Parallels Plesk Panel, we provided a suggested and unsupported workaround described in http://kb.parallels.com/en/113818.

  8. Re:Really? by gl4ss · · Score: 1

    PHP made me a multi-multi millionare

    And your point was again?

    what's a multi-multi? you have many millions of many millions?

    you're Gates, right? I knew windows had to be done on PHP.

    --
    world was created 5 seconds before this post as it is.
  9. Paralells charges to submit security issues by Anonymous Coward · · Score: 5, Interesting

    Paralells has no one to blame but themselves for this being posted publicly.

    Having found exploit code published on Pastebin for Plesk through an automated Google alert, I recently attempted to contact Paralells.

    I was unable to do so because I'm not a paying customer willing to pay to submit the security issue.

    You can read more about this problem over at my blog. http://caffeinesecurity.blogspot.com/2012/12/how-not-to-handle-software.html

  10. werd by fazey · · Score: 1

    way to sit on the exploit long enough for it to no longer matter.