CVE-2023-46818
📋 TL;DR
This vulnerability allows authenticated ISPConfig administrators to inject arbitrary PHP code through the language file editor when the admin_allow_langedit setting is enabled. This can lead to remote code execution on the server. Only ISPConfig installations with admin_allow_langedit enabled are affected.
💻 Affected Systems
- ISPConfig
📦 What is this software?
Ispconfig by Ispconfig
Ispconfig by Ispconfig
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise with attacker gaining complete control over the web server and potentially the underlying operating system.
Likely Case
Attacker executes arbitrary PHP code with web server privileges, potentially accessing databases, files, and executing system commands.
If Mitigated
No impact if admin_allow_langedit is disabled or if the system is patched.
🎯 Exploit Status
Exploitation requires admin credentials and admin_allow_langedit enabled. Public exploit code is available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.2.11p1
Vendor Advisory: https://www.ispconfig.org/blog/ispconfig-3-2-11p1-released/
Restart Required: No
Instructions:
1. Backup your ISPConfig installation and database. 2. Download ISPConfig 3.2.11p1 from the official website. 3. Follow the upgrade instructions in the ISPConfig documentation. 4. Verify the upgrade completed successfully.
🔧 Temporary Workarounds
Disable language file editing
linuxDisable the admin_allow_langedit setting to prevent exploitation.
Edit /usr/local/ispconfig/server/lib/config.inc.php and set $conf['admin_allow_langedit'] = false;
🧯 If You Can't Patch
- Disable admin_allow_langedit setting immediately.
- Restrict ISPConfig admin panel access to trusted IP addresses only.
🔍 How to Verify
Check if Vulnerable:
Check ISPConfig version and verify if admin_allow_langedit is enabled in config.inc.php.Check Version:
grep 'version' /usr/local/ispconfig/interface/lib/classes/template.inc.php | head -1Verify Fix Applied:
Verify ISPConfig version is 3.2.11p1 or later using the version check command.📡 Detection & Monitoring
Log Indicators:
- Unusual PHP file modifications in language directories
- Suspicious admin panel activity related to language editing
Network Indicators:
- Unexpected outbound connections from web server
- Unusual POST requests to language editor endpoints
SIEM Query:
source="ispconfig.log" AND ("language" OR "langedit") AND ("POST" OR "modify")🔗 References
- http://packetstormsecurity.com/files/176126/ISPConfig-3.2.11-PHP-Code-Injection.html
- http://seclists.org/fulldisclosure/2023/Dec/2
- https://www.ispconfig.org/blog/ispconfig-3-2-11p1-released/
- http://packetstormsecurity.com/files/176126/ISPConfig-3.2.11-PHP-Code-Injection.html
- http://seclists.org/fulldisclosure/2023/Dec/2
- https://www.ispconfig.org/blog/ispconfig-3-2-11p1-released/
