Being a skilled web server system administrator (sysadmin) is challenging. It requires extensive knowledge of Linux, web servers, networks, clouds, programming languages, platforms, frameworks, and security. Due to the lack of experienced sysadmins, many people rely on web hosts or cloud hosting control panels to manage their servers.
Selecting the right provider is difficult because it’s hard to gauge their expertise. I recently evaluated the security of 10 popular providers and services, including SpinupWP, Enhance.com, GridPane, Cloudways, RunCloud, and similar (I estimate that together they run several hundred thousand websites). For each provider, I set up a clean server and deployed multiple websites on it, simulating a scenario where a web agency manages several client websites on a single server.
My objective was straightforward: perform an unauthorized modification of one site on the server from another controlled site, essentially breaking site isolation.
The results were concerning. I successfully broke site isolation in 11 of 12 cases, despite considering myself only moderately skilled in system administration and security. I used only basic techniques that exploit well-known configuration vulnerabilities. For some services, I even found several methods to achieve my objective.
Providers I tested:
- Serveravatar – didn’t found the way how to break site isolation (but was able to bypass some default security measures and you have to be very careful with some of the features)
- Enhance.com -fixed instantly
- InstaWP – fixed
- Xcloud.host – fixed
- GridPane – fixed most issues pretty quick
- Ploi – investigating for 2 months, fix is ready
- Cloudways – not fixed after 3 months
- RunCloud – investigating few weeks, not fixed yet
- FlyWP – investigating more than month, not fixed yet
- Cloudpanel – will be fixed in distant future
- SpinupWP – feature not a bug
- Forge – don’t care
However, the presence of a vulnerable configuration is only one aspect of the problem. The other, potentially more critical issue, is the provider’s response and efforts to resolve the problem. This is where significant differences among the services emerged.
I must admit that this is the first time in my career that I will likely disclose vulnerabilities that may not yet be patched.
This decision stems from some providers’ lack of awareness of the problems. With Cloudways, I spent three months diligently working to address the issue, without any indication that anyone cares. On the other hand, Enhance.com reacted in few minutes, immediately understood the seriousness and fixed the issue in just hours.
I must confess that I was firstly motivated to wait patiently for the vision of a possible high bug bounty in the thousands of dollars. However, even the official bug bounty process seems to be stagnant and may involve additional obligations. Since exploiting site isolation requires control over one of the sites on the server (either a compromised site or a malicious client) and cannot be universally exploited, I determined that disclosing the problem would be most beneficial to users of this and similar services. This approach may prioritize the issue and enable other providers to learn from the vulnerability and secure their systems.
On the bright side, I have greatly improved my ability to explain security issues, and the design of my exploits has also advanced significantly. You can see for yourself (without technical details) in the video below.
In the coming days and weeks, I will begin sharing technical details and approaches to resolving and communicating with individual services. Spoiler: even a Docker doesn’t automatically guarantee security.
To stay informed about these details, consider subscribing to my blog newsletter.
Vladimir Smitka 
Leave a comment