ConfigServer Community Forum

From:
Fixed a SECURITY BUG in Quarantine file restore which could result in root privilege escalation. The destination restore file must not now exist before restoring will work. Our thanks to Jeff Petersen for reporting this issue

All cxs users should upgrade to this release immediately

From:
Further SECURITY improvements to Quarantine functionality

All cxs users should upgrade to this...

After some extensive testing we've discovered a feature in ModSecurity where a cxs scan can report a seemingly non-existent script on a server which is being exploited.

The symptoms:

Web upload script user: nobody (99)
Web upload script owner: ()
Web upload script: /home/user/public_html/store/admin
Remote IP: 1.2.3.4
Deleted: No
Quarantined: No

----------- SCAN REPORT -----------...

To enable file upload scanning for web scripts, ModSecurity needs to have the option SecRequestBodyAccess enabled (as explained in the install document).

This option configures whether request bodies will be buffered and processed by ModSecurity.

You will need to ensure that other any ModSecurity rules that you have have been correctly written to deal with POST_PAYLOADS. If they have not, then...

There are two files that you need to modify to allow blocking:

For FTP: /etc/cxs/cxsftp.sh

For Web Scripts: /etc/cxs/cxscgi.sh

1. If you simply want to delete suspicious uploads, add the --delete switch to cxsftp.sh and/or cxscgi.sh

2. If you want to quarantine files, then you need to pre-create the quarantine directory, e.g.:

mkdir /home/quarantine
chmod 1777 /home/quarantine

Then you...

When you run cxs you will invariably encounter false-positives that trigger one or more of the scanning options.

We do not recommend that you simply stop using the option that triggers, rather it would be better to simply ignore the false-positive files using an ignore file as per the documentation.

The best way to generate the ignore file is to create it first, e.g.:
touch...