texteditor
Premium Buffalo-based Hosting
Nick said he admitted it
SolusVM Vulnerability
- Thread starter George_Fusioned
- Start date
-
- Tags
- exploit hack solusvm vulnerability
darknessends
New Member
Soluslabs Ltd Sunday, June 16, 2013
06:31:41 PM GMT 0
PLEASE READ THIS INFORMATION CAREFULLY. THIS INFORMATION IS RELEVANT TO ALL VERSIONS OF SOLUSVM, INCLUDING BETA VERSIONS.
A security update has now been released for the Stable and Beta versions of SolusVM. We advise you to make this update as soon as possible.
To run the update you can either do it from within the SolusVM admin area or from CLI on the master server. To preform the update from CLI the commands differ depending on the version of SolusVM you are running.
==================
Stable version:
/scripts/upcp
Beta version:
/scripts/upcp-beta
==================
Once the update is complete you will have the patched system.
We have included the original instructions in this email that were given when the exploit was announced and before we released the patched updates. If you feel the need to remove the originally exploited file after the update you can do the following:
==================
06:31:41 PM GMT 0
PLEASE READ THIS INFORMATION CAREFULLY. THIS INFORMATION IS RELEVANT TO ALL VERSIONS OF SOLUSVM, INCLUDING BETA VERSIONS.
A security update has now been released for the Stable and Beta versions of SolusVM. We advise you to make this update as soon as possible.
To run the update you can either do it from within the SolusVM admin area or from CLI on the master server. To preform the update from CLI the commands differ depending on the version of SolusVM you are running.
==================
Stable version:
/scripts/upcp
Beta version:
/scripts/upcp-beta
==================
Once the update is complete you will have the patched system.
We have included the original instructions in this email that were given when the exploit was announced and before we released the patched updates. If you feel the need to remove the originally exploited file after the update you can do the following:
==================
Last edited by a moderator:
Tested both the beta and the stable and this appears to be now fixed, although can't say there aren't further exploits.
It's a pretty major flaw in the code. It may have been exploited before. I hope SolusVM do a full code review following this incident. I know they were moving things to PDO starting with 1.14, maybe that now needs to be their priority in addition to an external audit.
Maybe it will speed up the release of 1.14
The 1.14 beta suffered from the flaw. They need to move everything to PDO and not just gradually with each release. I think SolusVM has been getting a lot better as of late; however security must be their priority.Maybe it will speed up the release of 1.14
Oh for sure. I'm just glad they acknowledged the issue and provided a resolution as quickly as they did. Some other panels would likely have pretended nothing was wrong.
Agreed. Just a shame some good guys had to suffer as a result of this.
The only occurrence on our master was a user that attempted to access /rofl.php and it looks like he used Raymi's Control Panel URL list as a source to find our SolusVM URL. He was probably checking all providers one-by-one.
Too bad he was behind a VPN (AnchorFree)...
Too bad he was behind a VPN (AnchorFree)...
Just leaving this here..
cat /var/log/lighttpd/access.log | grep centralbackup.php
Derp.
[root@solus ~]# cat /var/log/lighttpd/access.log | grep centralbackup.php
91.42.26.6 solus.supremebytes.com - [16/Jun/2013:18:44:13 +0200] "GET /centralbackup.php HTTP/1.1" 404 345 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20100101 Firefox/21.0"
And then we have...
cat /var/log/lighttpd/access.log | grep rofl.php
Derp.
[root@solus ~]# cat /var/log/lighttpd/access.log | grep rofl.php
204.14.79.50 solus.supremebytes.com - [16/Jun/2013:14:22:20 +0200] "GET /rofl.php HTTP/1.1" 404 345 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.110 Safari/537.36"
I did however notice that 204.14.79.50 points to my home city: Columbus, Ohio. Seems a little strange because I am out of state at the moment and the service provider listed in the ip WHOIS has an invalid website address listed.
All the seen requests appear to have popped up after we deleted the files this morning.
cat /var/log/lighttpd/access.log | grep centralbackup.php
Derp.
[root@solus ~]# cat /var/log/lighttpd/access.log | grep centralbackup.php
91.42.26.6 solus.supremebytes.com - [16/Jun/2013:18:44:13 +0200] "GET /centralbackup.php HTTP/1.1" 404 345 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20100101 Firefox/21.0"
And then we have...
cat /var/log/lighttpd/access.log | grep rofl.php
Derp.
[root@solus ~]# cat /var/log/lighttpd/access.log | grep rofl.php
204.14.79.50 solus.supremebytes.com - [16/Jun/2013:14:22:20 +0200] "GET /rofl.php HTTP/1.1" 404 345 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.110 Safari/537.36"
I did however notice that 204.14.79.50 points to my home city: Columbus, Ohio. Seems a little strange because I am out of state at the moment and the service provider listed in the ip WHOIS has an invalid website address listed.
All the seen requests appear to have popped up after we deleted the files this morning.
