Articles in this section

Vulnerability: Privilege Escalation via Phusion Passenger's Watchdog API

Plesk Obsidian for Linux

Situation

A security vulnerability has been discovered in Phusion Passenger's Watchdog API.

Affected product version

Product Affected versions Patched versions
Plesk for Linux
  • All versions prior to 18.0.79.7 with Passenger installed
  • 18.0.80 - 18.0.80.2 with Passenger installed
  • 18.0.79.7
  • 18.0.80.3

Impact

Local privilege escalation is possible.

Call to action

Update Plesk to the latest build: How to update Plesk Obsidian to the latest build

Patching closes the vulnerability going forward, but it does not undo anything an attacker may have already done. If Passenger was installed and reachable on your server before you patched, we recommend checking for signs of prior compromise:

  1. Check /etc/ld.so.preload for unexpected entries. This is the file the exploit targets directly — any unfamiliar path listed there should be treated as a strong indicator of compromise.
  2. Review root's crontab and system-wide cron directories (/var/spool/cron/, /etc/cron.d/, /etc/cron.daily/, etc.) for jobs you don't recognize.
  3. Check for new SSH keys in /root/.ssh/authorized_keys and in the authorized_keys files of other system accounts.
  4. Check for new or unexpected Plesk administrator accounts, and any changes to existing admin account permissions.
  5. Look for unexpected SUID/SGID binaries on the filesystem (for example, find / -perm -4000 -o -perm -2000 and compare against a known-good baseline).

How to verify that a server is patched

Follow the steps from the How to find version of Plesk installed on server?

Was this article helpful?

Comments

1 comment
Date Votes
  • With all theses CVE's as of late; isn't it easier to simply (and only) use: plesk installer install-panel-updates

    Or do you really need to run plesk installer? Or is there a better method which answers yes/or continues the installer incase of warnings, altered templates, dead mariadb repos and so on?

    Please provide details. Thank you.

    0

Please sign in to leave a comment.