XenoPanel Directory Protector - Disables viewing other servers files.

Status
This thread has been locked.
Arisstath

Arisstath

NoLag.host - $0.80/GB - Custom Panel
Banned
Feedback score
3
Posts
212
Reactions
175
Resources
0
Hello, since Liam is not able to fix this easy security issue we had coded a custom permissions fix, we do not need it anymore cause of NoLagCP.

Source Code:
Code: 
package host.nolag.security;

import java.io.File;
import java.io.IOException;

public class Main {

    public static void main(String[] args) throws InterruptedException {
        System.out.println("NoLag.host - Read Access Protector");
        int count = 0;
        while (true) {
            count = 0;
            File[] files = new File("/home/XenoPanel/").listFiles();
            for (File file : files) {
               
                if (file.isDirectory()) {

                    try {
                        Runtime.getRuntime().exec("chmod go-rwx " + file.getPath());
                        count++;
                    } catch (IOException e) {
                        System.err.println("Failed to set permissions for file " + file.getPath());
                        e.printStackTrace();
                    }
                }

            }
            System.out.println("Secured " + count + " users!");
            Thread.sleep(1000 * 60);
        }
       
        // chmod go-rwx [usersHomeFolder]
    }
}
Compiled JAR: https://nolag.host/static/NoLagSecurity.jar

XenoPanel
 
Click to expand...
PebbleHost
High performance, consistent uptime and fast support. Minecraft hosting that just works.
Fire

Fire

Always DM me here before dealing via Discord.
Supreme
Feedback score
74
Posts
3,045
Reactions
1,745
Resources
0
Its quite concerning that a bug as serious as allowing users to access others files exists, let alone that the developer didnt patch it.

I was thinking of switching to Xeno a while back. Kind of glad i stuck with multicraft.
 
Latouth

Latouth

Troubled on Linux? Ask me!
Supreme
Feedback score
18
Posts
1,213
Reactions
504
Resources
0
TIL: There's more panels! I didn't know about XenoPanel lol
 
Fishfish0001

Fishfish0001

Feedback score
4
Posts
41
Reactions
106
Resources
0
Fire said:
Its quite concerning that a bug as serious as allowing users to access others files exists, let alone that the developer didnt patch it.

I was thinking of switching to Xeno a while back. Kind of glad i stuck with multicraft.
Click to expand...
Not to mention the authentication bypass exploit, as well as the one that allowed anyone to view any file on the system, and have root permissions to make edits. Hello /etc/shadow and /etc/passwd.

But maybe thats what happens when the creator of that panel appears to be more concerned with making other commercial products and bragging about how many servers they own on Discord. If you're going to offer a commercial product like this, most people expect that you'll actually put time into supporting and improving it, not running away when it starts breaking and people get mad. ¯\_(ツ)_/¯
 
Latouth

Latouth

Troubled on Linux? Ask me!
Supreme
Feedback score
18
Posts
1,213
Reactions
504
Resources
0
Fishfish0001 said:
Not to mention the authentication bypass exploit, as well as the one that allowed anyone to view any file on the system, and have root permissions to make edits. Hello /etc/shadow and /etc/passwd.

But maybe thats what happens when the creator of that panel appears to be more concerned with making other commercial products and bragging about how many servers they own on Discord. If you're going to offer a commercial product like this, most people expect that you'll actually put time into supporting and improving it, not running away when it starts breaking and people get mad. ¯\_(ツ)_/¯
Click to expand...
ptero ftw
 
5

58445

Deactivated
Feedback score
-1
Posts
51
Reactions
38
Resources
0
I'm kinda sad that I bought it a week before they dissapeared... I didnt get a refund at all...

I want to warn all of you guys, never buy something from that PERSON again
 
Ajdin

Ajdin

I used to be a big deal on here but now irrelevant
Supreme
Feedback score
12
Posts
2,419
Reactions
3,404
Resources
0
Joshua St.

Joshua St.

Visit our website today for hosting!
Supreme
Feedback score
0
Posts
128
Reactions
67
Resources
0
it's not even an issue in the latest downloads I'm pretty sure and either way it only allows view - and v2 Doesn't have any of those issues. I hope it works out for everyone though who uses the panel.
 
SafeSurf

SafeSurf

Why not?:)
Premium
Feedback score
3
Posts
262
Reactions
188
Resources
0
Joshua St. said:
it's not even an issue in the latest downloads I'm pretty sure and either way it only allows view - and v2 Doesn't have any of those issues. I hope it works out for everyone though who uses the panel.
Click to expand...
"only allows view"
Are you completly mad saying "only" in that sentence and acting up like that's nothing? Just tells a bit how security is ran at Zippy, if that's your view on it.
 
Joshua St.

Joshua St.

Visit our website today for hosting!
Supreme
Feedback score
0
Posts
128
Reactions
67
Resources
0
SafeSurf said:
"only allows view"
Are you completly mad saying "only" in that sentence and acting up like that's nothing? Just tells a bit how security is ran at Zippy, if that's your view on it.
Click to expand...
In comparison to being able to modify files, yes.. only. However, obviously it's not any good to see the files themselves. That being said, Zippy takes security very seriously. We operate as a company, so my opinion on things don't always mean my company reflects certain things that happen. For instance, we're actually leaving Xenopanel for another based on this issue and a few others we've experienced. Thanks though.
 
SafeSurf

SafeSurf

Why not?:)
Premium
Feedback score
3
Posts
262
Reactions
188
Resources
0
Joshua St. said:
In comparison to being able to modify files, yes.. only. However, obviously it's not any good to see the files themselves. That being said, Zippy takes security very seriously. We operate as a company, so my opinion on things don't always mean my company reflects certain things that happen. For instance, we're actually leaving Xenopanel for another based on this issue and a few others we've experienced. Thanks though.
Click to expand...
Actually, it's called PR.

If Tim Cook from Apple would hate muslims, it would effect the company aswell.


You get the point? I dont care whatever you use. Just a very spooky thing to take for granted.
 
Joshua St.

Joshua St.

Visit our website today for hosting!
Supreme
Feedback score
0
Posts
128
Reactions
67
Resources
0
SafeSurf said:
Actually, it's called PR.

If Tim Cook from Apple would hate muslims, it would effect the company aswell.


You get the point? I dont care whatever you use. Just a very spooky thing to take for granted.
Click to expand...
No one takes it for granted, the creator of XenoPanel said those words himself about the panel. He specifically said he's not worried about it because since the updates it's not even an issue anymore.

That being said, even if they could view the files I haven't seen any information to support that actually being an issue other than someone saying you can who has a bias standpoint.

Your comparison to Tim Cook and Muslims is far fetched from what were talking about. I'm not saying I support people looking at others files, I'm saying I have not seen that issue and was told directly from the creator Liam the panel shouldn't have that issue with the updates to it.
 
Last edited:
Fishfish0001

Fishfish0001

Feedback score
4
Posts
41
Reactions
106
Resources
0
Joshua St. said:
That being said, even if they could view the files I haven't seen any information to support that actually being an issue other than someone saying you can who has a bias standpoint.
Click to expand...
K78DT.png
2Vsbg.png
 

Attachments

  • K78DT.png
    K78DT.png
    512.9 KB · Views: 124
  • 2Vsbg.png
    2Vsbg.png
    447.9 KB · Views: 123
Status
This thread has been locked.
Top