Reported the issue to Solus. Their "audits" aren't very encouraging though.
SolusVM WHMCS Module Vulnerability
- Thread starter weservit
- Start date
D. Strout
Resident IPv6 Proponent
I hope you're right. Selling VPSes is getting to be enough of a headache without vulnerabilities in the underlying bits. I do come off a bit pessimistic there, really I'm excited to see some of the (hopefully better) software that will come out of these fiascoes.
D. Strout
Resident IPv6 Proponent
...To put it mildly. Really whether real change comes at this point depends on if SVM realizes that people are willing to ditch their product due to these issues and the utter lack of transparency. (They are, aren't they?) If there's any chance that sales will continue despite this, nothing will happen.
Unfortunately not. Capisso VMPanel, for example, is making the same exact security mistakes. And any software that is good, like Stallion or Cloudware is not likely to be handed out like candy.
No change will come because ultimately, the children running SolusVM (and let me assure you, 90% of SolusVM customers are children) will continue to run it, because the software enables them.
The serious players in this industry either gave up on Solus a long time ago (BuyVM, for example) or never ran it in the first place (Linode, Rackspace, etc).
Capisso etc. with or without the same security vulnerabilities won't ship either, because nobody will care. SolusVM will forgive a few months of licensing fees and that will be the end of it, I assure you.
The only way change will happen is if the customers stop paying for substandard products run by the substandard companies that provide them. If people refuse to buy VPSes managed by Solus, then you will have their attention.
lulzsecurity
New Member
pff.... so many lulz, where do I begin....
D. Strout
Resident IPv6 Proponent
I hope you're wrong. Take the LET > VPSB move. I never thought there would be any major move away from LET due to inertia. But there was. Hopefully someone will come through with a really good product and people will wake up, take notice, and switch.
Agreed.
The problem with your theory is that switching from LET to VPSB is easy: you just go to a new site.
Switching to a new panel is a much more complex proposition. Beyond that, the people delivering these panels (again I use Capisso VMPanel as an example here) are likely incapable of providing a migration tool if they even ship any code to begin with.
So, for migration, you're probably on your own. Now, if you're a typical host on here, meaning that you don't have the sufficient skills to run the business to begin with, but are able to fake it because SolusVM is good enough 75% of the time, are you really going to take the gamble with your livelyhood?
mikho
Not to be taken seriously, ever!
It was timing that made it possible, something that had been created before the hack of LET. Not after or because of it.
And it was something that was created by a member of LET who was well respected.
And come to think about it, it was actually a small change compared that a provider is about to change their backbone of their setup.
I guess that would be harder.
Last edited by a moderator:
Missed this one:
Whether or not the ModulesGarden module is safer has to do with whether or not the same behaviour is used. But, it probably safer to assume that the exact same method of POSTing to the SolusVM master is used, due to the nature of PHP coders to cut-and-paste code.
So, I'd say both modules are probably vulnerable in the same way... but I do not have access to the source of the ModulesGarden one to confirm that.
The vulnerability is in the fact that the "Solusvmpro" module does not filter form parameters and uses libcurl to POST to the SolusVM master.
Whether or not the ModulesGarden module is safer has to do with whether or not the same behaviour is used. But, it probably safer to assume that the exact same method of POSTing to the SolusVM master is used, due to the nature of PHP coders to cut-and-paste code.
So, I'd say both modules are probably vulnerable in the same way... but I do not have access to the source of the ModulesGarden one to confirm that.
Last edited by a moderator:
Fairly sure he already said he'd turn them down, even if offered 6 figures.SolusVM should hire that localhost.re guy to check their codes before a release
Best of luck to everyone,
Francisco
drmike
100% Tier-1 Gogent
Jack
Active Member
Chris knows, I messaged him as I figured he'd be first to get hit by it considering all he has posted about is restricting access to WHMCS only.
drmike
100% Tier-1 Gogent
I don't know why he's such a big target. It could be because he's the biggest.... mouth...?
Nice of you to give him a heads up though
Solus Labs give me an uneasy feeling in general. I am not in the industry, but do unfortunately end up using their product(s). Well, until sensible hosts took their software offline.
Solus can afford a 6 figure salary?
Jack
Active Member
Probably.