cPanel/Formail-Clone E-Mail Restriction Bypass Vulnerability

Bugtraq ID:	7758
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 30 2003 12:00AM
Updated:	May 30 2003 12:00AM
Credit:	Discovery of this vulnerability has been credited to Chad C. Keep <[email protected]>.
Vulnerable:	cPanel cPanel 6.4.2 cPanel cPanel 6.4.1 cPanel cPanel 6.4 cPanel cPanel 6.2 cPanel cPanel 6.0 cPanel cPanel 5.3 cPanel cPanel 5.0
Not Vulnerable:	cPanel cPanel 6.4.2 .STABLE_48

cPanel/Formail-Clone E-Mail Restriction Bypass Vulnerability

It has been reported that cPanel is prone to an issue where a remote attacker may bypass cPanel Formail-clone local domain checks and have untrusted e-mail delivered in the context of the vulnerable host.

This issue may be exploited by an attacker to use the vulnerable host as an open relay.

cPanel/Formail-Clone E-Mail Restriction Bypass Vulnerability

The following proof of concept has been supplied:

<input type="hidden" name="recipient"
value="user1@offsitedomain.(localdomain)co
m, user2@offsitedomain.(localdomain)com">

cPanel/Formail-Clone E-Mail Restriction Bypass Vulnerability

Solution:
The vendor has released an upgrade to address this issue:


cPanel cPanel 5.0

• cPanel Cpanel-6.4.2-STABLE_48
  http://www.cpanel.net/downloads.htm

cPanel cPanel 5.3

• cPanel Cpanel-6.4.2-STABLE_48
  http://www.cpanel.net/downloads.htm

cPanel cPanel 6.0

• cPanel Cpanel-6.4.2-STABLE_48
  http://www.cpanel.net/downloads.htm

cPanel cPanel 6.2

• cPanel Cpanel-6.4.2-STABLE_48
  http://www.cpanel.net/downloads.htm

cPanel cPanel 6.4

• cPanel Cpanel-6.4.2-STABLE_48
  http://www.cpanel.net/downloads.htm

cPanel cPanel 6.4.1

• cPanel Cpanel-6.4.2-STABLE_48
  http://www.cpanel.net/downloads.htm

cPanel cPanel 6.4.2

• cPanel Cpanel-6.4.2-STABLE_48
  http://www.cpanel.net/downloads.htm

cPanel/Formail-Clone E-Mail Restriction Bypass Vulnerability

References:

• cPanel Homepage (cPanel)