Vesta Control Panel - Forum

Hello!

I've been using VestaCP for a month. This is my very first post. I find this panel great. It has a complete set of features very useful for webmasters and end users. However, I was concern about its security risks. So I looked the web for breaches, hacks and stuff. And sadly, i found this online:

https://www.exploit-db.com/exploits/39468/

I tested it, and the XSS works!!!!

This should be fixed intermediately in the main distribution of VestaCP.

The fix is pretty easy. Just use htmlentities for the files output before they are sent to the browser:
There, find the line: and change it for: Now, I'm concern about others security breaches as this that we have not found yet. :( I know it is a long process...

What other things have you done to harden your VestaCP installation?

I'm implementing a way offer two factors authentication (password + SMS code). I hope to have something working soon. This will be a nice add-in for VestaCP.

I hope this help others to prevent nasty situations with their panels.

Regards

can you add a pull request
https://github.com/serghey-rodin/vesta/pulls

jonn wrote:can you add a pull request

Already is.. and will be in new version:
https://github.com/serghey-rodin/vesta/pull/639

skurudo wrote:

jonn wrote:can you add a pull request

Already is.. and will be in new version:
https://github.com/serghey-rodin/vesta/pull/639

Is critical bug, you need put micro updates to fix this, so there are a lot of vestacp there whit critical bug.

What is the estimated time to new versión ?

skamasle wrote: Is critical bug, you need put micro updates to fix this, so there are a lot of vestacp there whit critical bug.

It's will be possible after this version and after code refactoring.

skamasle wrote:What is the estimated time to new versión ?

Refactoring - done,
now bugs and test and here we go.
I think it's about two weeks.

skurudo wrote:

skamasle wrote: Is critical bug, you need put micro updates to fix this, so there are a lot of vestacp there whit critical bug.

It's will be possible after this version and after code refactoring.

skamasle wrote:What is the estimated time to new versión ?

Refactoring - done,
now bugs and test and here we go.
I think it's about two weeks.

Code refactoring :/ a lot of changes may be ?

So its posible some of my scripts dont working ( cpanel importer )

Can I test your new versión ? maybe be a betatester ?

skamasle wrote: Code refactoring :/ a lot of changes may be ?

Well, skid say - works a much faster.

skamasle wrote:So its posible some of my scripts dont working ( cpanel importer )
Can I test your new versión ? maybe be a betatester ?

Dunno, sorry.
It's needs to test, but don't think so.
Sorry, there no beta-testers yet, we think about beta-practice, but a bit later.

Ok dont worry, I wait new version :D

FIX
https://github.com/serghey-rodin/vesta/pull/639