CVE-2018-25117 in Control Panel
Summary
by MITRE • 10/15/2025
VestaCP commit a3f0fa1 (2018-05-31) up to commit ee03eff (2018-06-13) contain embedded malicious code that resulted in a supply-chain compromise. New installations created from the compromised installer since at least May 2018 were subject to installation of Linux/ChachaDDoS, a multi-stage DDoS bot that uses Lua for second- and third-stage components. The compromise leaked administrative credentials (base64-encoded admin password and server domain) to an external URL during installation and/or resulted in the installer dropping and executing a DDoS malware payload under local system privileges. Compromised servers were subsequently observed participating in large-scale DDoS activity. Vesta acknowledged exploitation in the wild in October 2018.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/17/2025
The vulnerability identified as CVE-2018-25117 represents a sophisticated supply-chain compromise targeting the VestaCP control panel software ecosystem. This security incident occurred between May 31, 2018, and June 13, 2018, when malicious code was embedded into the VestaCP installer through commits a3f0fa1 through ee03eff. The compromise exploited the trust model inherent in software distribution by injecting malicious functionality directly into the installation process, creating a persistent backdoor for attackers to establish unauthorized access to compromised systems. This type of attack demonstrates the critical importance of supply-chain security and the potential for attackers to compromise software at its most fundamental level.
The technical implementation of this malicious code involved multiple stages of attack delivery and credential exfiltration. During the installation process, the compromised installer would leak administrative credentials in base64-encoded format to external command and control servers, effectively providing attackers with direct access to compromised systems. The malware payload, specifically targeting Linux/ChachaDDoS, employed a multi-stage approach utilizing Lua scripting for second- and third-stage components, which allowed for dynamic execution and evasion of traditional security measures. This approach aligns with ATT&CK framework technique T1059.007 for Lua-based execution and demonstrates the sophisticated nature of modern malware delivery mechanisms that leverage legitimate scripting languages to avoid detection.
The operational impact of this vulnerability extended far beyond simple credential theft, as compromised servers were subsequently observed participating in large-scale distributed denial-of-service activities. This transformation of compromised systems into botnet nodes represents a classic example of how supply-chain attacks can be leveraged for broader cybercriminal operations. The malware's ability to execute under local system privileges provided attackers with sufficient access to manipulate system resources and participate in coordinated DDoS campaigns. This vulnerability exemplifies the ATT&CK technique T1489 for Data Destruction and T1071.004 for Application Layer Protocol: DNS, as compromised systems were used to generate network traffic for DDoS attacks. The compromise affected new installations created from May 2018 onward, indicating a prolonged window of exposure and potential for widespread impact across the VestaCP user base.
The security implications of this vulnerability extend to several established security frameworks and standards, including CWE-494, which addresses the risk of code downloaded from untrusted sources, and CWE-284, which covers improper access control in software installations. The incident highlights the critical need for software integrity verification mechanisms and proper code review processes, particularly for open-source projects that rely on community contributions. Organizations implementing VestaCP during the affected period faced the dual challenge of credential exposure and subsequent DDoS participation, requiring comprehensive incident response procedures including credential rotation, system scanning for malware, and network monitoring for DDoS attack patterns. The vulnerability also underscores the importance of maintaining up-to-date security practices and the necessity of implementing robust software verification processes to prevent similar supply-chain compromises in the future.
Security practitioners should consider implementing network-based detection measures to identify DDoS traffic patterns originating from compromised systems, as well as endpoint monitoring for Lua script execution and unusual credential exfiltration activities. The incident serves as a reminder that even legitimate software distribution channels can become compromised, requiring organizations to maintain vigilance and implement defense-in-depth strategies that include software integrity verification, continuous monitoring, and rapid incident response capabilities. The compromise of VestaCP during this period demonstrates how attackers can leverage trusted software installation processes to establish persistent access and utilize compromised systems for large-scale malicious activities, emphasizing the need for comprehensive threat hunting and proactive security measures.