Facebook
TwitterJamesWhitaker
New Pleskian
Recently I found what I believed to be a security vulnerability in Plesk.
After several hours of investigation, I wrote a detailed report setting out my findings and explaining how the bug could be reproduced.
I wanted to share that report with the Plesk team so that the security vulnerability could be fixed (responsible disclosure).
However, contacting Plesk turned out to be a huge problem.
I first wrote to the email-address listed on the Plesk Github page ([email protected]), but recieved a reply from Microsoft stating that this address did not exist or did not accept emails.
I then tried to create an account on this forum, but due to technical difficulties it was not possible to activate my account at that time.
I tried to submit a request to the support team, but was blocked by the system because my license is provided by my hosting provider, and I'm therefore not eligible for direct support.
I searched the entire Plesk website for contact information, but only found this (Contact Us - Plesk Support Will Help).
I submitted a message detailing my problem and asking for a way to report the security vulnerability.
The (sales) staff were unwilling to address this and said I needed to purchase a support licence.
Over the next couple of weeks I tried to tell them I was not looking for support and wanted to REPORT a vulnerability.
The answer remained the same.
At some point someone even said to contact my hosting provider and that it was their problem. (I tried that and they referred me back to Plesk straight away (obviously).)
After about three weeks, I gave up and wrote one final message in which I expressed my dissatisfaction in no uncertain terms about the way the situation had been handled.
Eventually, a supervisor stepped in and gave me permission to submit my report, which she would then forward to the developers.
They have since investigated and fixed the bug.
Dear Plesk, reporting vulnerabilities should be A LOT easier!
PS; Even if I would have been able to open an account on this forum at the time, I still would have had a problem.
I can hardly publish an active exploit on a public forum.
There really should be a contact form for the dev/security-team for this purpose.
After several hours of investigation, I wrote a detailed report setting out my findings and explaining how the bug could be reproduced.
I wanted to share that report with the Plesk team so that the security vulnerability could be fixed (responsible disclosure).
However, contacting Plesk turned out to be a huge problem.
I first wrote to the email-address listed on the Plesk Github page ([email protected]), but recieved a reply from Microsoft stating that this address did not exist or did not accept emails.
I then tried to create an account on this forum, but due to technical difficulties it was not possible to activate my account at that time.
I tried to submit a request to the support team, but was blocked by the system because my license is provided by my hosting provider, and I'm therefore not eligible for direct support.
I searched the entire Plesk website for contact information, but only found this (Contact Us - Plesk Support Will Help).
I submitted a message detailing my problem and asking for a way to report the security vulnerability.
The (sales) staff were unwilling to address this and said I needed to purchase a support licence.
Over the next couple of weeks I tried to tell them I was not looking for support and wanted to REPORT a vulnerability.
The answer remained the same.
At some point someone even said to contact my hosting provider and that it was their problem. (I tried that and they referred me back to Plesk straight away (obviously).)
After about three weeks, I gave up and wrote one final message in which I expressed my dissatisfaction in no uncertain terms about the way the situation had been handled.
Eventually, a supervisor stepped in and gave me permission to submit my report, which she would then forward to the developers.
They have since investigated and fixed the bug.
Dear Plesk, reporting vulnerabilities should be A LOT easier!
PS; Even if I would have been able to open an account on this forum at the time, I still would have had a problem.
I can hardly publish an active exploit on a public forum.
There really should be a contact form for the dev/security-team for this purpose.
