New WHMCS Exploit

[Aldryic C'boas]

http://localhost.re/p/whmcs-527-vulnerability

tl;dr - A rather gaping security hole in WHMCS.  I've taken ours offline - strongly suggest other providers do the same.

 

[concerto49]

Have you contacted WHMCS? Just did.

 

[fapvps]

Yeah this one is pretty bad. We took ours down also.

 

[Jono20201]

Damn. Disabled ours for now, has this been confirmed? Does just putting the system into Maintenance mode make it 'safe'?

 

[Aldryic C'boas]

Damn. Disabled ours for now, has this been confirmed? Does just putting the system into Maintenance mode make it 'safe'?

Yes, this is confirmed.  After seeing the... utterly incompetant coding practices, I wouldn't trust just using Maintenance mode.  I ripped down our entire install and just put up a placeholder for now.

 

[DamienSB]

Yes, this is confirmed.  After seeing the... utterly incompetant coding practices, I wouldn't trust just using Maintenance mode.  I ripped down our entire install and just put up a placeholder for now.

[root@moonbase ~]# service httpd stop
Stopping httpd:                                            [  OK  ]
[root@moonbase ~]#

 

[Jono20201]

Yes, this is confirmed.  After seeing the... utterly incompetant coding practices, I wouldn't trust just using Maintenance mode.  I ripped down our entire install and just put up a placeholder for now.

Mind if I nick your parts of your maintenance message? Too tired to think of something decent.

[root@moonbase ~]# service httpd stop
Stopping httpd:                                            [  OK  ]


[root@moonbase ~]#

Surely best to put a html message up?

 

[Aldryic C'boas]

Mind if I nick your parts of your maintenance message? Too tired to think of something decent.

Nah, go for it, I don't mind.

 

[rds100]

 


RewriteCond %{QUERY_STRING} AES_ENCRYPT

RewriteRule ^(.+) /sorry.html [L]

 

 

This helps? Not sure if %{QUERY_STRING} would catch POST data or what would be the correct variable for that.

 

[DamienSB]

Mind if I nick your parts of your maintenance message? Too tired to think of something decent.


Surely best to put a html message up?

Didn't know if the exploit was real or not - why spend 5 minutes on an error page when you might remove it in an hour. But it looks like this is real, so I’m going to make a page. But either way, people aren't going to care why it is down.

 

[Erawan]

So this is why RamNode went down for the client area?

 

[George_Fusioned]

I added the following on top of my .htaccess

Order allow,deny
Allow from 127.0.0.1 # for email piping to work
Allow from x.x.x.x # my VPN IP
Deny from all

 

[rds100]

@George_Fusioned you might want to also add these:

allow from 173.0.81.1

allow from 173.0.81.33

allow from 66.211.170.66

 

This is to allow paypal's IPN to still work (for subscribtion payments that you might receive).

 

[AnthonySmith]

I assume it affects pre 5.2.7 as well?

 

[Aldryic C'boas]

I assume it affects pre 5.2.7 as well?

The file in question is an old one, pre 4.* days.  I can't imagine they would replace a secure, working file with the atrocity there now, so safest just to assume all versions are affected.

 

[Nick_A]

So this is why RamNode went down for the client area?

Yes.

 

[Jono20201]

Wonder how long it'll take WHMCS. Hope they aren't thinking "we'll fix it monday". Lot of lost business.

 

[MCH-Phil]

Our billing system is now offline as well.  Oh well another fun day

 

[Jono20201]

http://blog.whmcs.com/?t=79274

Lets hope their not all on a plane back home.

 

[Aldryic C'boas]

Wonder how long it'll take WHMCS. Hope they aren't thinking "we'll fix it monday". Lot of lost business.

http://blog.whmcs.com/?t=79274

Lets hope their not all on a plane back home.

David's working on a fix now, from the hotel lobby.