5 ms·

Ages ago I used php-nuke to manage my forum and it got hacked and I thought it would get taken seriously Seeing these CPanel hacks remind me how old these code

Ages ago I used php-nuke to manage my forum and it got hacked and I thought it would get taken seriously Seeing these CPanel hacks remind me how old these codebases are and how much more vulnerability remain

bouncycastle 6mo ago
Cpanel is Perl, not PHP. Probably the grayest of the gray beards. Perhaps not enough Perl Wizards left to maintain it nowadays.
- dminvs 6mo ago
  well, any accounts running outdated workloads (could be anything LAMP-flavored) could be attack vectors, with the entire shared machine possibly compromised by any weak account due to these latest LPEs these cPanel machines frequently run 4- or low-5-figure quantities of customer accounts, each with potentially multiple domains or CMS deployments, and not always the most technically-engaged customer base, so that's a lot of surface area to account for: how diligent can hosts realistically be about every WordPress plugin, every Drupal or Magento module, and so on? (nb I don't like shared hosting and am not defending it, just addressing the reality of the long tail)
dainiusse 6mo ago
I don't agree that "old" necessarily implies vulnerability.
- pixl97 6mo ago
  I mostly disagree on your disagreement unless the entire project was based on top security practices and good code in the first place. The vast majority of these web panels are a security nightmare.
  - omnimus 6mo ago
    These PHP systems be it cPanel, wordpress or PHP itself are most likely the biggest target besides windows. It's incredibly uncool stack especially here but it is running most of the "independent" small web. They cannot be that bad if they are managing to be ductape of the internet.
    - anamexis 6mo ago
      How does that follow?
      - cinntaile 6mo ago
        They have a big target on their back so the low hanging fruit is (mostly) gone.
    - hvb2 6mo ago
      > They cannot be that bad if they are managing to be ductape of the internet. I think there are just a whole lot of tools written for them. So non devs can spin things up and click some things together. Is that safe and secure? Maybe, if the devs did their work well. But I'm positive no one reads the docs on how to configure something securely. I think the real reason is that it's very cheap to host, and always has been
    - ChocolateGod 6mo ago
      cPanel is Perl.
      - robocat 6mo ago
        Yes. Perl for core backend logic, automation, legacy systems, APIs. Some other languages used for bits and pieces. https://api.docs.cpanel.net/guides/guide-to-perl https://api.docs.cpanel.net/guides/guide-to-perl
    - Meekro 6mo ago
      I've done PHP development for over 20 years, including some pretty large projects. I've never had a situation where a security flaw in PHP itself forced me to scramble to patch something before it got hacked. On the other hand, for my Linux servers, I had to do that twice in the last month with CopyFail and DirtyFrag.
- tclancy 6mo ago
  As a coder who just hit 50, trust me, it does.
TZubiri 6mo ago
[flagged]
- ricardonunez 6mo ago
  Of course is the architecture and the creator of such a thing, isn’t the point of a tool like that for users that don’t have the tech knowledge? I have only used those systems on shared hosting, host providers are the one maintaining and should be keeping them up to date and WHM/Cpnel have plenty of customers to worry too patch holes, if they can’t then who’s fault is it, Architecture, or provider? Hope is the customers fault?
  - walrus01 6mo ago
    I would worry less about big shared hosting providers, who have a strong interest in patching their stuff quickly, than the market of people who get one or two dedicated servers or KVM VMs and then install cpanel on them and for the rest of the time they use it, ignore the CLI of the servers and never patch anything. There's a lot of small users of cpanel that have just a few licenses.
    - TZubiri 6mo ago
      You misunderstood the scope and severity of the bug entirely. Yes, if you are a single tenant, this diminishes defense in depth, so an attacker that gets access with a user like www-data can escalate to root, sure. But more importantly, on multi-tenant systems, one tenant can get root and pwn all the other tenants. Big shared hosting providers are the most vulnerable, 'just patching' stuff might work sure, but there's several scenarios where it might not be enough, like lightning striking twice as it just happened. Or an attacker getting in before the patch.
      - walrus01 6mo ago
        I understand the concept of a local privilege escalation just fine, thanks. My point was that large hosting providers are much more likely to have people paying attention to patching these things (and possibly, worst case scenario as you describe, mitigating things if someone does compromise a shared hosting system). Individual one-off cpanel instances may have nobody paying attention to security issues for months or years at a time until something totally breaks.
doublerabbit 6mo ago
Php-nuke was the hacking testing ground. Nuke was atrocious for exploitation.
- jszymborski 6mo ago
  I was thinking about php-nuke I while back and it's terrible security rep. I figured it was just the regular PHP foot guns of the era, but I took a look at the code recently and boy howdy that was some truly atrocious code. I'm not security person (although perhaps security minded) and I found a million problems after a cursory glance.

bouncycastle 6mo ago

Cpanel is Perl, not PHP. Probably the grayest of the gray beards. Perhaps not enough Perl Wizards left to maintain it nowadays.

dminvs 6mo ago
well, any accounts running outdated workloads (could be anything LAMP-flavored) could be attack vectors, with the entire shared machine possibly compromised by any weak account due to these latest LPEs these cPanel machines frequently run 4- or low-5-figure quantities of customer accounts, each with potentially multiple domains or CMS deployments, and not always the most technically-engaged customer base, so that's a lot of surface area to account for: how diligent can hosts realistically be about every WordPress plugin, every Drupal or Magento module, and so on? (nb I don't like shared hosting and am not defending it, just addressing the reality of the long tail)

dainiusse 6mo ago

I don't agree that "old" necessarily implies vulnerability.

pixl97 6mo ago
I mostly disagree on your disagreement unless the entire project was based on top security practices and good code in the first place. The vast majority of these web panels are a security nightmare.
- omnimus 6mo ago
  These PHP systems be it cPanel, wordpress or PHP itself are most likely the biggest target besides windows. It's incredibly uncool stack especially here but it is running most of the "independent" small web. They cannot be that bad if they are managing to be ductape of the internet.
  - anamexis 6mo ago
    How does that follow?
    - cinntaile 6mo ago
      They have a big target on their back so the low hanging fruit is (mostly) gone.
  - hvb2 6mo ago
    > They cannot be that bad if they are managing to be ductape of the internet. I think there are just a whole lot of tools written for them. So non devs can spin things up and click some things together. Is that safe and secure? Maybe, if the devs did their work well. But I'm positive no one reads the docs on how to configure something securely. I think the real reason is that it's very cheap to host, and always has been
  - ChocolateGod 6mo ago
    cPanel is Perl.
    - robocat 6mo ago
      Yes. Perl for core backend logic, automation, legacy systems, APIs. Some other languages used for bits and pieces. https://api.docs.cpanel.net/guides/guide-to-perl https://api.docs.cpanel.net/guides/guide-to-perl
  - Meekro 6mo ago
    I've done PHP development for over 20 years, including some pretty large projects. I've never had a situation where a security flaw in PHP itself forced me to scramble to patch something before it got hacked. On the other hand, for my Linux servers, I had to do that twice in the last month with CopyFail and DirtyFrag.
tclancy 6mo ago
As a coder who just hit 50, trust me, it does.

TZubiri 6mo ago

[flagged]

ricardonunez 6mo ago
Of course is the architecture and the creator of such a thing, isn’t the point of a tool like that for users that don’t have the tech knowledge? I have only used those systems on shared hosting, host providers are the one maintaining and should be keeping them up to date and WHM/Cpnel have plenty of customers to worry too patch holes, if they can’t then who’s fault is it, Architecture, or provider? Hope is the customers fault?
- walrus01 6mo ago
  I would worry less about big shared hosting providers, who have a strong interest in patching their stuff quickly, than the market of people who get one or two dedicated servers or KVM VMs and then install cpanel on them and for the rest of the time they use it, ignore the CLI of the servers and never patch anything. There's a lot of small users of cpanel that have just a few licenses.
  - TZubiri 6mo ago
    You misunderstood the scope and severity of the bug entirely. Yes, if you are a single tenant, this diminishes defense in depth, so an attacker that gets access with a user like www-data can escalate to root, sure. But more importantly, on multi-tenant systems, one tenant can get root and pwn all the other tenants. Big shared hosting providers are the most vulnerable, 'just patching' stuff might work sure, but there's several scenarios where it might not be enough, like lightning striking twice as it just happened. Or an attacker getting in before the patch.
    - walrus01 6mo ago
      I understand the concept of a local privilege escalation just fine, thanks. My point was that large hosting providers are much more likely to have people paying attention to patching these things (and possibly, worst case scenario as you describe, mitigating things if someone does compromise a shared hosting system). Individual one-off cpanel instances may have nobody paying attention to security issues for months or years at a time until something totally breaks.

doublerabbit 6mo ago

Php-nuke was the hacking testing ground. Nuke was atrocious for exploitation.

jszymborski 6mo ago
I was thinking about php-nuke I while back and it's terrible security rep. I figured it was just the regular PHP foot guns of the era, but I took a look at the code recently and boy howdy that was some truly atrocious code. I'm not security person (although perhaps security minded) and I found a million problems after a cursory glance.