CVE-2023-5839 (Shell, published 2023-10-29T01:15Z)
Description: value: Privilege Chaining in GitHub repository hestiacp/hestiacp prior to 1.8.9.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-268 \u2014 Privilege Chaining
Two distinct privileges, roles, capabilities, or rights can be combined in a way that allows an entity to perform unsafe actions that would not be allowed without that combination.
Repository: https://github.com/hestiacp/hestiacp
Files changed:
bin/v-add-web-php
install/deb/php-fpm/dummy.conf
install/deb/php-fpm/www.conf
install/hst-install-debian.sh
install/hst-install-ubuntu.sh
install/upgrade/manual/secure_php.sh
install/upgrade/versions/1.8.9.sh
Commit message: Limit permissions dummy.conf and www.conf prevent permission escalation  (#4095)

* Apply changes to default config

If users want less stricter system they can undo it

* Make changes for new install

* Fix few sed commands

* And CLI as well

* Update script


* Replace dummy.conf with unix socket 

Use correct file

Add comment on changes

Vulnerable code:
	exit "$E_INVALID";
sed -i "s/9999/99$v_tpl/g" /etc/php/$version/fpm/pool.d/dummy.conf
[www]
listen = 127.0.0.1:9999
listen.allowed_clients = 127.0.0.1
user = www-data
user = www-data

Fixed code:
	exit "$E_INVALID"
sed -i "s/%backend_version%/$version/g" /etc/php/$version/fpm/pool.d/dummy.conf
sed -i "s/;max_input_vars = 1000/max_input_vars = 4000/g" /etc/php/$version/fpm/php.ini

# Disable exec and other harmfull php functions
sed -i "s/disable_functions =.*/disable_functions = pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,exec,system,passthru,shell_exec,proc_open,popen/g" /etc/php/$version/fpm/php.ini

sed -i "s/disable_functions =.*/disable_functions = pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,exec,system,passthru,shell_exec,proc_open,popen/g" /etc/php/$version/cli/php.ini

# Other use full changes
sed -i "s/;opcache.enable=1/opcache.enable=1/g" /etc/php/$version/fpm/php.ini
sed -i "s/;opcache.memory_consumption=128/opcache.memory_consumption=512/g" /etc/php/$version/fpm/php.ini
sed -i "s/;opcache.max_accelerated_files=10000/opcache.max_accelerated_files=100000/g" /etc/php/$version/fpm/php.ini
[wwww]
listen = /run/php/php%backend_version%-fpm.dummy.sock
listen.owner = hestiamail
listen.group = www-data
listen.mode = 0660
;"hestiamail" user created to prevent users from abusing this config
user = hestiamail
;"hestiamail" user created to prevent users from abusing this config
user = hestiamail
# Create user for php-fpm configs
/usr/sbin/useradd "hestiamail" -c "$email" --no-create-home

# Create user for php-fpm configs
/usr/sbin/useradd "hestiamail" -c "$email" --no-create-home

#!/bin/bash
# info: Secure websites FPM / CLI against basic executions if you use such functions remove them form the list

sed -i "s/disable_functions =.*/disable_functions = pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,exec,system,passthru,shell_exec,proc_open,popen/g" /etc/php/*/fpm/php.ini

sed -i "s/disable_functions =.*/disable_functions = pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,exec,system,passthru,shell_exec,proc_open,popen/g" /etc/php/*/cli/php.ini

# Fix security issue wit FPM pools
if [ -z "$(grep ^hestiamail: /etc/passwd)" ]; then
	echo "[ * ] Limit permissions www.conf and dummy.conf"
	/usr/sbin/useradd "hestiamail" -c "$email" --no-create-home

	sed -i "s/user = www-data/user = hestiamail/g" /etc/php/*/fpm/pool.d/www.conf

	php_versions=$($BIN/v-list-sys-php plain)
	# Substitute php-fpm service name formats
	for version in $php_versions; do
		cp -f $HESTIA_INSTALL_DIR/php-fpm/dummy.conf /etc/php/$version/fpm/pool.d/
		sed -i "s/%backend_version%/$version/g" /etc/php/$version/fpm/pool.d/dummy.conf
	done
fi