CVE-2012-2087
📋 TL;DR
This vulnerability in ISPConfig 3.0.4.3 allows authenticated users with 'Add new Webdav user' permissions to execute chmod and chown commands on the entire server through the client interface. This affects all ISPConfig installations running version 3.0.4.3 where the WebDAV user management feature is enabled.
💻 Affected Systems
- ISPConfig
📦 What is this software?
Ispconfig by Ispconfig
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise allowing attackers to modify file permissions and ownership across the entire system, potentially leading to privilege escalation, data theft, or complete system takeover.
Likely Case
Unauthorized users gaining administrative control over web server files, allowing them to modify website content, install backdoors, or access sensitive data.
If Mitigated
Limited impact if proper access controls and network segmentation are implemented, restricting the attack surface.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once credentials are obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.0.4.4 and later
Vendor Advisory: http://www.ispconfig.org/
Restart Required: No
Instructions:
1. Backup current ISPConfig installation. 2. Update to ISPConfig 3.0.4.4 or later. 3. Verify WebDAV user permissions are properly restricted.
🔧 Temporary Workarounds
Disable WebDAV user management
linuxTemporarily disable the vulnerable WebDAV user management feature until patching is possible.
# Edit ISPConfig configuration to disable WebDAV user management
# Consult ISPConfig documentation for specific configuration changes
Restrict user permissions
linuxRemove 'Add new Webdav user' permissions from all non-administrative accounts.
# Use ISPConfig admin interface to modify user permissions
# Navigate to System > User Management and adjust permissions
🧯 If You Can't Patch
- Implement strict network segmentation to isolate ISPConfig administration interface
- Enable detailed logging and monitoring for WebDAV user management activities
🔍 How to Verify
Check if Vulnerable:
Check ISPConfig version via admin interface or by examining installation files. Version 3.0.4.3 is vulnerable.Check Version:
grep -r 'ISPConfig 3.0.4.3' /usr/local/ispconfig/ || cat /usr/local/ispconfig/interface/lib/ispconfig_version.phpVerify Fix Applied:
Verify ISPConfig version is 3.0.4.4 or later and test WebDAV user management functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual chmod/chown commands executed via WebDAV interface
- Multiple WebDAV user creation attempts from single account
- File permission changes outside normal web directories
Network Indicators:
- HTTP POST requests to WebDAV user management endpoints with command parameters
SIEM Query:
source="ispconfig.log" AND ("chmod" OR "chown") AND "webdav"🔗 References
- http://www.openwall.com/lists/oss-security/2012/04/08/3
- http://www.openwall.com/lists/oss-security/2012/04/09/4
- https://exchange.xforce.ibmcloud.com/vulnerabilities/74739
- https://www.securityfocus.com/bid/52936
- http://www.openwall.com/lists/oss-security/2012/04/08/3
- http://www.openwall.com/lists/oss-security/2012/04/09/4
- https://exchange.xforce.ibmcloud.com/vulnerabilities/74739
- https://www.securityfocus.com/bid/52936
