Issue How to stop cron abuse?

[tkalfaoglu]

Server operating system version

Rocky Linux 8.9

Plesk version and microupdate number

Obsidian latest

Hello there. I found out some cron job belonging to a customer when I went into PLESK settings:
I can't post it as this server won't accept it, but it's a one liner that downloads a file from some hellodolly site and runs it

this was put into their crontab even though the owner of that domain does not have permission to schedule jobs according to PLESK.
I believe cron can protect itself from such jobs using /etc/cron.d/cron.allow and deny files.
What would be the required users to put into the allow file for plesk?
I assume root and psaadm?

Regards, -turgut

 

[tkalfaoglu]

PS: I checked and NO plan on the system has access to the Scheduler..

 

[Bitpalast]

The problem can be that path traversal is done by a malicious PHP script, and the directory where the cron files are stored can be reached. New cron files can be written to it. These will then show up as new cron jobs in the scheduler. The newer the PHP version, the less danger there is. In PHP versions 5.6 or older it was very easy to break out of the base URL jail. In newer versions it became more difficult, but I would not guarantee for that it cannot be done. So if you still have old PHP running on your server, a first good step is to remove it.

 

[WebHostingAce]

I have had the similar experience.

Please see - Question - Wordpress Hacked! Unusual Plesk Behavior