Description
cPanel 9.4.1-RELEASE-64 follows hard links, which allows local users to (1) read arbitrary files via the backup feature or (2) chown arbitrary files via the .htaccess file when Front Page extensions are enabled or disabled.
References
- cpanel-htaccess-modify-ownership(17780) vdb-entry
- 20041018 cPanel hardlink backup issue mailing-list
- cpanel-backup-view-file(17779) vdb-entry
- 20041018 cPanel hardlink chown issue mailing-list
- 11455 vdb-entry
- 12865 third-party-advisory
- 11449 vdb-entry