ZSA-2019-2 - CloudLinux CageFS bypass by creating user with existing exception

Details: Created: 01 December 2019; Last Updated: 01 December 2019

Vulnerability

Affected software: CloudLinux CageFS versions below 6.1.9-2

CloudLinux keeps CageFS excludes in /etc/cagefs/exclude/systemuserlist file, which is generated during CageFS installation. By default it contains user names which might not be in a system, like varnish. If user orders DirectAdmin account named varnish or user is a reseller and creates user varnish, then that user will be outside CageFS.

Solution

Update CageFS to version 6.1.9-2 or later.

Timeline

2019-07-26 - Vulnerability reported to vendor.
2019-07-26 - Response from vendor.
2019-09-12 - Beta version 6.1.9-2 of CageFS released with CAG-940 vulnerability fixed.
2019-09-17 - Production version 6.1.9-2 of CageFS released with CAG-940 vulnerability fixed.