Plesk Panel "Web Statistics" Permission Issue
15.04.2022
The bash vulnerability announced yesterday affects all versions between 3.0 and 4.2.x. It allows remote code execution when bash can be accessed over the network without authentication. You must update bash to close the vulnerability.
First, run the following command on your running system:
env x=‘() { :;}; echo vulnerable’ bash -c “echo this is a test”
If the output is as follows, the mentioned vulnerability exists on your server:
vulnerable
this is a test
To update, simply run:
yum update bash -y
If you have successfully applied the patch, run the first command again:
env x=‘() { :;}; echo vulnerable’ bash -c “echo this is a test”
The output should be:
bash: warning: x: ignoring function definition attempt
bash: error importing function definition for ‘x’
this is a test
If you get the above output, you have no need to worry — the vulnerability has been patched.
Leave a Comment
* Your comment will be published after approval.
Comments
1<p>Merhaba bu açık sadece eğer web sunucusunda cgi tarzı bir web yazılımı veya dışarıya yani 3. tarafa açık bir web servisi varsa işe yarar.Diğer türlü sadece php çalışan bir sunucu üstünde bu açığı kulanıma açmak neredeyse imkansız gibi bir durumdur.</p>