Skip to content

v1.2.2 — Security fixes (root command execution, MySQL account takeover) + Laravel 13

Choose a tag to compare

View all tags
@crivion crivion released this 21 Sep 14:55
· 12 commits to main since this release
v1.2.2
81fc6df
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

This is a security release fixing two critical vulnerabilities. Every install should upgrade, especially any that host more than one customer.

Security

Both issues could be exploited by any ordinary logged-in tenant. No admin access or shell access was needed.

  • Root command execution through the website document root (GHSA-38vh-2qjr-xpmg). The document root entered when creating a website was passed unvalidated into a sed program run as root, so crafted input could run arbitrary commands as root. The same field also allowed ../ traversal and injecting lines into the Apache config. The document root is now restricted to a plain relative path. The root helpers fill templates without sed, validate every argument, and refuse to create directories outside the tenant's own domains folder.
  • Takeover of the panel's MySQL account through a database password (GHSA-68m9-96fg-rqm5). Database passwords were interpolated into CREATE USER / ALTER USER, so a crafted password could also change the password of the privileged laranode MySQL account. Passwords are now sent as properly escaped literals, and charset/collation must be a pair the MySQL server actually supports.

Both were reported by mattw-services, who handled them responsibly and supplied clear reproductions.

Changed

  • Upgraded to Laravel 13, which requires PHP 8.3 or newer. Installs made with the installer already run PHP 8.4. On an older PHP, the upgrader stops before changing anything and tells you what to do.

Upgrading

curl -sSL https://raw.githubusercontent.com/crivion/laranode/refs/heads/main/laranode-scripts/bin/laranode-upgrade.sh | bash

Once it finishes, check that the commit the upgrader prints matches this release.

Websites and databases created before upgrading keep their stored values. If you host tenants you don't fully trust, check /etc/apache2/sites-available/*.conf for unexpected DocumentRoot paths or directives, and confirm the laranode MySQL account's password still matches DB_PASSWORD in .env.

Assets 2
Loading