Vesta Control Panel up to 0.9.8 list/backup/index.php backup os command injection

Summaryinfo

A vulnerability was found in Vesta Control Panel up to 0.9.8. It has been classified as critical. Affected is an unknown function of the file list/backup/index.php. Performing a manipulation of the argument backup as part of Shell Metacharacter results in os command injection. This vulnerability is reported as CVE-2015-4117. The attack is possible to be carried out remotely. Moreover, an exploit is present. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Vesta Control Panel up to 0.9.8. It has been classified as critical. This affects an unknown code block of the file list/backup/index.php. The manipulation of the argument backup as part of a Shell Metacharacter leads to a os command injection vulnerability. CWE is classifying the issue as CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Vesta Control Panel before 0.9.8-14 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the backup parameter to list/backup/index.php.

The bug was discovered 06/17/2015. The weakness was disclosed 02/28/2018 as EDB-ID 37369 as confirmed exploit (Exploit-DB). The advisory is shared at exploit-db.com. This vulnerability is uniquely identified as CVE-2015-4117 since 05/28/2015. It is possible to initiate the attack remotely. The requirement for exploitation is a authentication. Technical details and a public exploit are known. MITRE ATT&CK project uses the attack technique T1202 for this issue.

A public exploit has been developed by High-Tech Bridge SA and been published even before and not after the advisory. The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 987 days. During that time the estimated underground price was around $0-$5k. By approaching the search of inurl:list/backup/index.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 0.9.8-14 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Exploit-DB (37369). The entry VDB-75992 is pretty similar. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Vesta

Name

• Control Panel

Version

• 0.9.0
• 0.9.1
• 0.9.2
• 0.9.3
• 0.9.4
• 0.9.5
• 0.9.6
• 0.9.7
• 0.9.8

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion