CVE-2023-5839: Privilege Chaining (CWE-268)
value: Privilege Chaining in GitHub repository hestiacp/hestiacp prior to 1.8.9.
CWE description: Two distinct privileges, roles, capabilities, or rights can be combined in a way that allows an entity to perform unsafe actions that would not be allowed without that combination.
CVSS v3 base score: 7.8
Published: 2023-10-29T01:15Z
Repository: https://github.com/hestiacp/hestiacp
Language: Shell
Files changed: bin/v-add-web-php, install/deb/php-fpm/dummy.conf, install/deb/php-fpm/www.conf, install/hst-install-debian.sh, install/hst-install-ubuntu.sh, install/upgrade/manual/secure_php.sh, install/upgrade/versions/1.8.9.sh
Commit date: 2023-10-24 10:32:56 +0200
Commit message: Limit permissions dummy.conf and www.conf prevent permission escalation  (#4095)

* Apply changes to default config

If users want less stricter system they can undo it

* Make changes for new install

* Fix few sed commands

* And CLI as well

* Update script


* Replace dummy.conf with unix socket 

Use correct file

Add comment on changes
Diff: diff --git a/bin/v-add-web-php b/bin/v-add-web-php
index 9163f1b3a0..c6c46fbeb6 100755
--- a/bin/v-add-web-php
+++ b/bin/v-add-web-php
@@ -48,11 +48,11 @@ if [ -f "$php_fpm" ] && [ -f "$HESTIA/data/templates/web/php-fpm/PHP-${version/\
 fi
 
 # Check if php version is supported
 if [[ ! "$multiphp_v" =~ $version ]]; then
 	echo "ERROR: Specified PHP version is not supported or does not exist."
-	exit "$E_INVALID";
+	exit "$E_INVALID"
 fi
 
 # Perform verification if read-only mode is enabled
 check_hestia_demo_mode
 
@@ -129,18 +129,29 @@ fi
 # Configure fpm
 update-rc.d php$version-fpm defaults > /dev/null 2>&1
 v_tpl=${version//./}
 rm -f /etc/php/$version/fpm/pool.d/*
 cp -f $HESTIA_INSTALL_DIR/php-fpm/dummy.conf /etc/php/$version/fpm/pool.d/
-sed -i "s/9999/99$v_tpl/g" /etc/php/$version/fpm/pool.d/dummy.conf
+sed -i "s/%backend_version%/$version/g" /etc/php/$version/fpm/pool.d/dummy.conf
 cp -f $HESTIA_INSTALL_DIR/php-fpm/php-fpm.conf /etc/php/$version/fpm/
 sed -i "s/fpm_v/$version/g" /etc/php/$version/fpm/php-fpm.conf
 
 # Increase max upload and max post size
 sed -i "s/upload_max_filesize = 2M/upload_max_filesize = 100M/g" /etc/php/$version/fpm/php.ini
 sed -i "s/post_max_size = 8M/post_max_size = 100M/g" /etc/php/$version/fpm/php.ini
 sed -i "s/max_execution_time = 30/max_execution_time = 60/g" /etc/php/$version/fpm/php.ini
+sed -i "s/;max_input_vars = 1000/max_input_vars = 4000/g" /etc/php/$version/fpm/php.ini
+
+# Disable exec and other harmfull php functions
+sed -i "s/disable_functions =.*/disable_functions = pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,exec,system,passthru,shell_exec,proc_open,popen/g" /etc/php/$version/fpm/php.ini
+
+sed -i "s/disable_functions =.*/disable_functions = pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,exec,system,passthru,shell_exec,proc_open,popen/g" /etc/php/$version/cli/php.ini
+
+# Other use full changes
+sed -i "s/;opcache.enable=1/opcache.enable=1/g" /etc/php/$version/fpm/php.ini
+sed -i "s/;opcache.memory_consumption=128/opcache.memory_consumption=512/g" /etc/php/$version/fpm/php.ini
+sed -i "s/;opcache.max_accelerated_files=10000/opcache.max_accelerated_files=100000/g" /etc/php/$version/fpm/php.ini
 
 # Install backend template
 cp -f $HESTIA_INSTALL_DIR/php-fpm/multiphp.tpl \
 	$HESTIA/data/templates/web/php-fpm/PHP-${version/\./_}.tpl
 
diff --git a/install/deb/php-fpm/dummy.conf b/install/deb/php-fpm/dummy.conf
index 781ec89b18..afebb366ae 100644
--- a/install/deb/php-fpm/dummy.conf
+++ b/install/deb/php-fpm/dummy.conf
@@ -1,12 +1,15 @@
 ; origin-src: deb/php-fpm/dummy.conf
 
-[www]
-listen = 127.0.0.1:9999
-listen.allowed_clients = 127.0.0.1
+[wwww]
+listen = /run/php/php%backend_version%-fpm.dummy.sock
+listen.owner = hestiamail
+listen.group = www-data
+listen.mode = 0660
 
-user = www-data
+;"hestiamail" user created to prevent users from abusing this config
+user = hestiamail
 group = www-data
 
 pm = ondemand
 pm.max_children = 4
 pm.max_requests = 4000
diff --git a/install/deb/php-fpm/www.conf b/install/deb/php-fpm/www.conf
index c27207cc67..d701aedb76 100644
--- a/install/deb/php-fpm/www.conf
+++ b/install/deb/php-fpm/www.conf
@@ -2,11 +2,12 @@
 
 [www]
 listen = 127.0.0.1:9000
 listen.allowed_clients = 127.0.0.1
 
-user = www-data
+;"hestiamail" user created to prevent users from abusing this config
+user = hestiamail
 group = www-data
 
 pm = ondemand
 pm.max_children = 4
 pm.max_requests = 4000
diff --git a/install/hst-install-debian.sh b/install/hst-install-debian.sh
index 298c77b718..fdb5fd2b04 100755
--- a/install/hst-install-debian.sh
+++ b/install/hst-install-debian.sh
@@ -1125,10 +1125,13 @@ random_password=$(gen_pass '32')
 # Create the new hestiaweb user
 /usr/sbin/useradd "hestiaweb" -c "$email" --no-create-home
 # do not allow login into hestiaweb user
 echo hestiaweb:$random_password | sudo chpasswd -e
 
+# Create user for php-fpm configs
+/usr/sbin/useradd "hestiamail" -c "$email" --no-create-home
+
 # Enable SFTP subsystem for SSH
 sftp_subsys_enabled=$(grep -iE "^#?.*subsystem.+(sftp )?sftp-server" /etc/ssh/sshd_config)
 if [ -n "$sftp_subsys_enabled" ]; then
 	sed -i -E "s/^#?.*Subsystem.+(sftp )?sftp-server/Subsystem sftp internal-sftp/g" /etc/ssh/sshd_config
 fi
diff --git a/install/hst-install-ubuntu.sh b/install/hst-install-ubuntu.sh
index e2a1c3c12f..cccaccbcfc 100755
--- a/install/hst-install-ubuntu.sh
+++ b/install/hst-install-ubuntu.sh
@@ -1093,10 +1093,13 @@ random_password=$(gen_pass '32')
 # Create the new hestiaweb user
 /usr/sbin/useradd "hestiaweb" -c "$email" --no-create-home
 # do not allow login into hestiaweb user
 echo hestiaweb:$random_password | sudo chpasswd -e
 
+# Create user for php-fpm configs
+/usr/sbin/useradd "hestiamail" -c "$email" --no-create-home
+
 # Enable SFTP subsystem for SSH
 sftp_subsys_enabled=$(grep -iE "^#?.*subsystem.+(sftp )?sftp-server" /etc/ssh/sshd_config)
 if [ -n "$sftp_subsys_enabled" ]; then
 	sed -i -E "s/^#?.*Subsystem.+(sftp )?sftp-server/Subsystem sftp internal-sftp/g" /etc/ssh/sshd_config
 fi
diff --git a/install/upgrade/manual/secure_php.sh b/install/upgrade/manual/secure_php.sh
new file mode 100644
index 0000000000..47a33d1861
--- /dev/null
+++ b/install/upgrade/manual/secure_php.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+# info: Secure websites FPM / CLI against basic executions if you use such functions remove them form the list
+
+sed -i "s/disable_functions =.*/disable_functions = pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,exec,system,passthru,shell_exec,proc_open,popen/g" /etc/php/*/fpm/php.ini
+
+sed -i "s/disable_functions =.*/disable_functions = pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,exec,system,passthru,shell_exec,proc_open,popen/g" /etc/php/*/cli/php.ini
diff --git a/install/upgrade/versions/1.8.9.sh b/install/upgrade/versions/1.8.9.sh
index 1b7b7ae7e3..5c88433513 100644
--- a/install/upgrade/versions/1.8.9.sh
+++ b/install/upgrade/versions/1.8.9.sh
@@ -31,5 +31,20 @@ hestia_defaults_conf="$HESTIA/conf/defaults/hestia.conf"
 
 if [ -f /etc/nginx/nginx.conf ]; then
 	echo "[ * ] Mitigate HTTP/2 Rapid Reset Attack via Nginx CVE CVE-2023-44487"
 	sed -i -E 's/(.*keepalive_requests\s{1,})10000;/\11000;/' /etc/nginx/nginx.conf /usr/local/hestia/nginx/conf/nginx.conf
 fi
+
+# Fix security issue wit FPM pools
+if [ -z "$(grep ^hestiamail: /etc/passwd)" ]; then
+	echo "[ * ] Limit permissions www.conf and dummy.conf"
+	/usr/sbin/useradd "hestiamail" -c "$email" --no-create-home
+
+	sed -i "s/user = www-data/user = hestiamail/g" /etc/php/*/fpm/pool.d/www.conf
+
+	php_versions=$($BIN/v-list-sys-php plain)
+	# Substitute php-fpm service name formats
+	for version in $php_versions; do
+		cp -f $HESTIA_INSTALL_DIR/php-fpm/dummy.conf /etc/php/$version/fpm/pool.d/
+		sed -i "s/%backend_version%/$version/g" /etc/php/$version/fpm/pool.d/dummy.conf
+	done
+fi

Vulnerable code: 	exit "$E_INVALID";
sed -i "s/9999/99$v_tpl/g" /etc/php/$version/fpm/pool.d/dummy.conf
[www]
listen = 127.0.0.1:9999
listen.allowed_clients = 127.0.0.1
user = www-data
user = www-data
Fixed code: 	exit "$E_INVALID"
sed -i "s/%backend_version%/$version/g" /etc/php/$version/fpm/pool.d/dummy.conf
sed -i "s/;max_input_vars = 1000/max_input_vars = 4000/g" /etc/php/$version/fpm/php.ini

# Disable exec and other harmfull php functions
sed -i "s/disable_functions =.*/disable_functions = pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,exec,system,passthru,shell_exec,proc_open,popen/g" /etc/php/$version/fpm/php.ini

sed -i "s/disable_functions =.*/disable_functions = pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,exec,system,passthru,shell_exec,proc_open,popen/g" /etc/php/$version/cli/php.ini

# Other use full changes
sed -i "s/;opcache.enable=1/opcache.enable=1/g" /etc/php/$version/fpm/php.ini
sed -i "s/;opcache.memory_consumption=128/opcache.memory_consumption=512/g" /etc/php/$version/fpm/php.ini
sed -i "s/;opcache.max_accelerated_files=10000/opcache.max_accelerated_files=100000/g" /etc/php/$version/fpm/php.ini
[wwww]
listen = /run/php/php%backend_version%-fpm.dummy.sock
listen.owner = hestiamail
listen.group = www-data
listen.mode = 0660
;"hestiamail" user created to prevent users from abusing this config
user = hestiamail
;"hestiamail" user created to prevent users from abusing this config
user = hestiamail
# Create user for php-fpm configs
/usr/sbin/useradd "hestiamail" -c "$email" --no-create-home

# Create user for php-fpm configs
/usr/sbin/useradd "hestiamail" -c "$email" --no-create-home

#!/bin/bash
# info: Secure websites FPM / CLI against basic executions if you use such functions remove them form the list

sed -i "s/disable_functions =.*/disable_functions = pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,exec,system,passthru,shell_exec,proc_open,popen/g" /etc/php/*/fpm/php.ini

sed -i "s/disable_functions =.*/disable_functions = pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,exec,system,passthru,shell_exec,proc_open,popen/g" /etc/php/*/cli/php.ini

# Fix security issue wit FPM pools
if [ -z "$(grep ^hestiamail: /etc/passwd)" ]; then
	echo "[ * ] Limit permissions www.conf and dummy.conf"
	/usr/sbin/useradd "hestiamail" -c "$email" --no-create-home

	sed -i "s/user = www-data/user = hestiamail/g" /etc/php/*/fpm/pool.d/www.conf

	php_versions=$($BIN/v-list-sys-php plain)
	# Substitute php-fpm service name formats
	for version in $php_versions; do
		cp -f $HESTIA_INSTALL_DIR/php-fpm/dummy.conf /etc/php/$version/fpm/pool.d/
		sed -i "s/%backend_version%/$version/g" /etc/php/$version/fpm/pool.d/dummy.conf
	done
fi