Security: Privilege Escalation via Phusion Passenger's Watchdog API

Situation A security vulnerability has been discovered in Phusion Passenger's Watchdog API. Note: This does not affect default installations of cPanel. This vulnerability is only applicable to servers where an affected package has been installed. Please check the "Affected Product Versions" Table for a full list of vulnerable packages. Affected Product Versions Product Affected Versions Patched Versions cPanel/WHM All versions with one of the following packages installed: ea-apache24-mod-passenger ea-passenger-src ea-ruby27-rubygem-passenger ea-ruby27-mod_passenger ea-ruby24-rubygem-passenger ea-ruby24-mod_passenger ea-nginx-passenger ea-apache24-mod-passenger: 6.1.8-2 ea-passenger-src: 6.1.8-2 ea-ruby27-rubygem-passenger: 6.0.27-2 (el7), 6.1.8-2 (el8) ea-ruby27-mod_passenger: 6.0.27-2 (el7), 6.1.8-2 (el8) ea-ruby24-rubygem-passenger: 6.0.20-4 ea-ruby24-mod_passenger: 6.0.20-4 ea-nginx-passenger: 6.1.8-2 Impact Local privilege escalation is possible. Call to action Note: CloudLinux engineering is currently preparing and testing patched packages. This page will be updated once those packages are available for CloudLinux systems. Make sure the Passenger packages are updated to the latest version. The following command can be used to update all packages: # /scripts/update-packages Alternatively, the following commands can be used to update those individual packages as needed. These commands will only update packages that are already installed on the server: CentOS 7/CloudLinux 7 # yum update ea-apache24-mod-passenger ea-nginx-passenger ea-ruby27-rubygem-passenger ea-ruby27-mod_passenger ea-ruby24-rubygem-passenger ea-ruby24-mod_passenger AlmaLinux/CloudLinux 8/9/10 # dnf update ea-apache24-mod-passenger ea-nginx-passenger ea-ruby27-rubygem-passenger ea-ruby27-mod_passenger ea-ruby24-rubygem-passenger ea-ruby24-mod_passenger Ubuntu # apt update && apt install --only-upgrade ea-apache24-mod-passenger If Passenger was installed and reachable on your server before it was patched, the following command can be used to check for signs of compromise: CPANEL_WARN: Please note that a clean result does not confirm a server was not exploited as these entries are not written at the default log level. Unless the log level has already been raised on your server these would not be recorded. # grep -E 'API account database is empty|Authentication failed for UID' /etc/apache2/logs/error_log /usr/local/apache/logs/error_log 2>/dev/null The log level can be raised if needed to capture any future attempts via the following steps: Log in to WHM as the root user, and access Home / Service Configuration / Apache Configuration / Include Editor Under the Pre Main Include section, select All Versions from the drop-down add the following: CONFIG_TEXT: PassengerLogLevel 4 Click the Update button to save the configuration, and the Restart Apache button on the next page to restart the service. How to verify that a server is patched The following commands can be used to confirm the currently installed version of the Passenger packages: CentOS/AlmaLinux/CloudLinux # rpm -q ea-apache24-mod-passenger ea-passenger-src ea-ruby27-rubygem-passenger ea-ruby27-mod_passenger ea-ruby24-rubygem-passenger ea-ruby24-mod_passenger ea-nginx-passenger Ubuntu # dpkg-query -W -f='${Package} ${Version}\n' ea-apache24-mod-passenger ea-passenger-src ea-ruby27-rubygem-passenger ea-ruby27-mod_passenger ea-ruby24-rubygem-passenger ea-ruby24-mod_passenger ea-nginx-passenger