New WHMCS Security Advisory for 5.x

[nigelb]

WHMCS has released new patches for the 5.2 and 5.1 minor releases. These updates
provide targeted changes to address security concerns with the WHMCS product.
You are highly encouraged to update immediately.

WHMCS has rated these updates as having critical & important security
impacts. Information on security ratings is available at
http://docs.whmcs.com/Security_Levels

== Releases ==

The following patch release versions of WHMCS have been published to address all
known vulnerabilities:
v5.2.12
v5.1.13

== Security Issue Information ==

These updates resolve the following issues:

> Information disclosure via the client area as published by 'localhost'
> HTTP Split Attack discovered by the WHMCS Development Team
> SQL Injection Vulnerability discovered by the WHMCS Development Team
> Privilege boundaries not being enforced on addons reported by Vlad C of
NetSec Interative
> Download directory traversal reported privately by an individual
> Lack of input validation in data feeds input discovered by the WHMCS
Development Team
> Deficient Null Byte sanitization on input discovered by the WHMCS
Development Team

== Important Fix Information ==

These updates also include the following non-security related functional fixes:

> Improved validation of monetary amounts
> Moneris Vault Gateway compatibility update
> Credit cards not processing under certain conditions
> Correction to internal logic for testing Authorize.net payment gateway


== Mitigation ==

=== WHMCS Version 5.2 ===

Download and apply the appropriate patch files to protect against these
vulnerabilities.

Patch files for affected versions of the 5.2 series are located on the WHMCS
site as itemized below.

v5.2.12 (full version) - Downloadable from the WHMCS Members Area

v5.2.12 (patch only; for 5.2.10 or 5.2.11 ) -
http://go.whmcs.com/254/5212_incremental

To apply a patch, download the files indicated above and replace the files
within your installation.
No upgrade process is required.

=== WHMCS Version 5.1 ===

Download and apply the appropriate patch files to protect against these
vulnerabilities.

Patch files for affected versions of the 5.1 series are located on the WHMCS
site as itemized below.

v5.1.13 (patch only; for 5.1.12) - http://go.whmcs.com/250/5113_incremental

To apply a patch, download the files indicated above and replace the files
within your installation.
No upgrade process is required.


========================================


WHMCS Limited
www.whmcs.com

- Members Area: https://www.whmcs.com/members/
- Support: http://www.whmcs.com/support/
- Documentation: http://docs.whmcs.com/
- Community Forums: http://forums.whmcs.com/

 

[HN-Alejo]

Thanks for posting.

With all these recent security advisories, it makes me wonder when WHMCS will have their auto update script. Do they have plans for this?

 

[nigelb]

Not sure if they have any plans for that.

 

[Adler01]

Thank you for the helpful post

 

[Alex - A2 Hosting]

Thanks for posting.

With all these recent security advisories, it makes me wonder when WHMCS will have their auto update script. Do they have plans for this?

Not sure if they have any plans for that.

Hopefully if this comes around it won't bring anymore security issues .

It looks like they have plans to do a full security audit, so hopefully things will start to look up once that has been completed and everything that has been found gets patched.

 

[4D Hosting]

Thanks for the post - very helpful!

 

[nigelb]

We did the update straight away and within a couple of hours it stopped an issue.
Moral; keep up to date its worth it.

 

[Host Pro]

Thank you for the post, we have upgraded today

 

[komodovpn]

I'm just fortunate that the upgrading process is easy enough and doesn't cause a major headache each time a new patch is released.

 

[nigelb]

Its well worth keep a check on the site if you dont get updates
http://docs.whmcs.com/Main_Page

 

[visiba]

Its well worth keep a check on the site if you dont get updates
http://docs.whmcs.com/Main_Page

Or subscribe to this mailing list:
http://www.hostingseclist.com/

 

[blazews]

any auto update plugins for WHMCS ???

 

[Alex - A2 Hosting]

any auto update plugins for WHMCS ???

Without WHMCS involvement there can not be any "auto-update" plugins. Your best option is via Softaculous and even then, it only automatically updates once they have pushed the patch through (usually fast, but not instant).

And in some cases if the upgrader needs to be run, Softaculous will just download it and forward you to the normal upgrade page of WHMCS so again, not instant.

 

[visiba]

WHMCS is not really built for auto-updates because some updates also require template changes. If you have based your own template on a default template, you might have to modify your template to include the default template changes.

 

[Jump systems]

There has been alot of minor updates for whmcs of late. These are mostly security related. Is whmcs becoming more vulnerable by the day?

 

[LampNetworks]

any auto update plugins for WHMCS ???

Auto update is a feature request that looks like it will be implemented in a future release but not enabled by default:
https://requests.whmcs.com/responses/automatic-update-utility

 

[WebHostWala]

It has a small bug - mass mail dont work

 

[easyhostmedia]

for bugs you can use their new bug reporting tool at http://bugs.whmcs.com

It also looks like they are letting security issues be handled by BugCrowd.com and a Security Bounty Program, which means that security can be handled by anyone that is part of this program

http://blog.whmcs.com/?t=82691

 

[Dominatos]

Just amazing how many security issues with so important industry standard software.

 

[easyhostmedia]

Just amazing how many security issues with so important industry standard software.

True and now it seems they are wiping their hands of security issues by allowing a third party site made up of anyone to handle security issues