Security Advisory 2020-01-28

[brian!]

Haven't seen this mentioned here yet, so I thought it worth posting a link for those that didn't get the notice from WHMCS.

https://docs.whmcs.com/Security_Advisory_2020-01-28

Quote

About the vulnerability

A potential security vulnerability exists when htaccess directives are not enforced appropriately for WHMCS.

WHMCS ships with a vendor directory which should not be publicly accessible. By default a .htaccess file is provided which in most cases would be sufficient to direct the web server to disallow web based access to files in that location. nginx in particular will not honor that directive.

We have recently become aware of malicious actors scanning the internet for vulnerable web server configurations that host WHMCS installations. Improperly configured web servers could allow an unauthenticated, remote attacker to access sensitive WHMCS data.

As a result, we are rating the severity of this issue as critical.

This advisory was published on 28th January 2020.

Affected versions

WHMCS 6.0 and later

How to tell if you're affected

If the following file is readable from a web browser, then you need to investigate and apply appropriate configurations for your web server environment.

https://www.example.com/path/to/whmcs/vendor/composer/LICENSE

A verification tool has also been made available to assist in determining if your web server environment is affected. This tool can be downloaded here.

To use the tool, simply upload it to the root directory of your WHMCS installation and then visit in a browser or run from the command line. The tool will confirm if you are affected.

How to fix the vulnerability

The solution depends upon your web server environment and various configurations.

Apache Web Server Software

Apache is the recommended web server software platform to run WHMCS on. By default a .htaccess file is provided which in most cases should be sufficient to direct the Apache web server to disallow web based access to files within the vendor directory.

If you are running Apache and files remain accessible, please first ensure that the /vendor/.htaccess file exists, then you will want to investigate if your Apache configuration has disabled the use of .htaccess files or if there is a parent configuration that is negating the directive in the provided .htaccess file.

Other Web Server Software

While other web server technologies are not officially supported, we understand that some users do wish to run WHMCS in environments other than Apache.

For those that do, you must ensure that files within the /vendor/ directory are not served based on your web server configuration.

To help with this, we have made available the following help resources:

LiteSpeed

LiteSpeed uses the same configuration format as Apache HTTP Server and is compatible with most Apache features, including .htaccess files. The default .htaccess file provided should in most cases be sufficient to direct the LiteSpeed web server to disallow web based access to files within the vendor directory.

If you are running LiteSpeed and files remain accessible, please first ensure that the /vendor/.htaccess file exists, then you will want to investigate if your LiteSpeed configuration has disabled the use of .htaccess files or if there is a parent configuration that is negating the directive in the provided .htaccess file.

Nginx

A detailed guide for how to restrict access to directories with nginx has been made available at https://docs.whmcs.com/Nginx_Directory_Access_Restriction

Microsoft IIS

To restrict access to directories on IIS systems, perform the following steps:

1. Open IIS Manager
2. Navigate to Web Sites\<your website>\vendor
3. In the right pane, double-click “Authentication"
4. For “Anonymous Authentication”, choose “Disabled”
5. Restart IIS

Others

If your web server software is not listed here, please consult with your server administrator or contact our technical support team for further advice.

Technical Support

WHMCS understands that customers may have questions about this vulnerability or need assistance in determining if they are affected, and we are ready to assist as needed. For support on this issue, please open a support ticket

 

[WHMCS ChrisD]

Hi @brian!

Thank you for your post regarding the Security Advisory Notice that we released today. 

We have emailed all direct license holders advising them of this security advisory and provided a public announcement on our blog outlining the details along with a link to the support documentation explaining the details along with steps that can be taken to address this.

Our team is ready to assist any users that require support to address this issue.  Direct License Holders can contact us here.  Users with licenses from a reseller or web host can contact us here.