Security issues with Bash CGI

[harizalan]

Good day!

I have detected a few – closely linked – security issues on the Johnny server. First question: where could I contact the developers privately? Of course, it is possible that only I am concerned about insignificant problems, but, for example, being able to bypass the storage limit does not seem to be good.

 

Thank you!

[Unknown025]

Users that bypass the storage limit face a Plesk suspension. That said, if you have genuine security problems to bring up, a root administrator might reach out directly.

[harizalan]

I have genuine security problems... for bypassing the storage limit, the problem itself is that Plesk does not „see” anything outside the home directory. Thus, I was able to create a rather huge file in /tmp (by running a Bash-based CGI script), which is continuously accessible between two restarts, and Plesk has still shown that my account has the same amount of disk space remaining. Methinks it is an issue. And there are a few other problems as well...