7

Is it possible for a vulnerability in one application to be exploited to attack another application on the same server?

So according to the answer to the question above it is possible that when one website on a server is vulnerable to remote execution it implies that all websites hosted on the same server could possibly be compromised.

Therefore I was wondering if one would create a website with this vulnerability on purpose. Then let it be hosted by a hosting provider. Such a hosting provider probably has somewhere around 50 websites hosted on one server.

Could this lead to compromise of all the other websites on this server? If no, how is this prevented? If yes, how could one prevent this?

Discussion on this question has lead to a new question regarding prevention of this thread: How do hosting providers prevent the compromise of one website from causing the compromise of another one?

|improve this question
11

You wouldn't need the vulnerable website if you have an account on the shared hosting already. What you need is code execution on the host. A remote code execution vulnerability in one of the hosted websites gives you that, sure. But if you have your own account already, why not just upload whatever code you want to run?

I guess installing a vulnerable application could be a way to try to avoid being held responsible for the attack ("it wasn't me, I was hacked"). But it is not strictly needed.

Companies that offer shared hosting has to try to segregate the different accounts as much as possible. This is not always an easy thing to do. Vulnerabilities in the operative system or server misconfigurations can be exploited to gain access to other accounts. A good hosting provider could make such attacks hard by keeping software up to date and configuring things properly. But cheap is seldom good, and shared hosting is often cheap.

|improve this answer
  • Yes that is true, but when looking from an attacker's perspective it would make more sense to hide behind an old and vulnerable wordpress website of a bookclub that he himself created and uploaded. This would give him opportunity to research the system anonymously and when he get's detected the hosting provider would think the actual client who was attacked just did not update to a safer wordpress version which is a common mistake – Just van der Veeken May 30 '18 at 8:23
  • @JustvanderVeeken Just thought the same thought, see my edit. :-) Yeah, you are right, it could be used in that way. – Anders May 30 '18 at 8:24
  • You have any idea if this actually is a real scenario used by attackers? It seems a matter of privilege escalation only and this could lead to compromise of many websites right? – Just van der Veeken May 30 '18 at 8:28
  • 3
    @JustvanderVeeken I honestly don't know exactly how it works. Could be a separate question, but to avoid it being to broad you might want to specify what OS or technology stack you are interested in. – Anders May 30 '18 at 9:00
  • 1
    I agree with @Anders here, I suggest posting that as a new question if asked correctly I think it could be a good one – J.J May 30 '18 at 9:59
-1

Having a vulnerability suggests a weakness that would be exploited by an attacker, which is not really the case when the attacker already has access to the system (the hosting provider).

What you seem to be asking is the possibility of exploiting other tenants on the systems, which is far too larger question to answer in one, and is dependant on the way the resources are shared on the server.

|improve this answer

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.