PT-2020-12337 · Vestacp · Vesta Control Panel

Mehmet Ince · Published 2020-03-22 · Updated 2023-02-03 · CVE-2020-10808

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Vesta Control Panel (VestaCP) versions 0.9.8-26 and earlier

Description The issue allows Command Injection via the "schedule/backup Backup Listing Endpoint". An attacker must be able to create a crafted filename on the server. This can be demonstrated by an FTP session that renames .bash logout to a .bash logout substring followed by shell metacharacters.

Recommendations For versions 0.9.8-26 and earlier, as a temporary workaround, consider restricting access to the schedule/backup Backup Listing Endpoint until a patch is available. Avoid using crafted filenames on the server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2020-10808

Affected Products

Vesta Control Panel

References · 9

• 🔥 https://github.com/rapid7/metasploit-framework/pull/13094 · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/vestacp_exec.rb · Exploit
• 🔥 http://packetstormsecurity.com/files/157219/Vesta-Control-Panel-Authenticated-Remote-Code-Execution.html · Exploit
• 🔥 http://packetstormsecurity.com/files/157111/Vesta-Control-Panel-Authenticated-Remote-Code-Execution.html · Exploit
• 🔥 https://pentest.blog/vesta-control-panel-second-order-remote-code-execution-0day-step-by-step-analysis · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-10808 · Security Note
• https://osv.dev/vulnerability/CVE-2020-10808 · Vendor Advisory
• https://forum.vestacp.com/viewforum.php?f=25 · Vendor Advisory
• https://t.me/cvenotify/1989 · Telegram Post