Vesta XSS at logs Topic is solved

[vestingpanel]

Hello!

I've been using VestaCP for a month. This is my very first post. I find this panel great. It has a complete set of features very useful for webmasters and end users. However, I was concern about its security risks. So I looked the web for breaches, hacks and stuff. And sadly, i found this online:

https://www.exploit-db.com/exploits/39468/

I tested it, and the XSS works!!!!

This should be fixed intermediately in the main distribution of VestaCP.

The fix is pretty easy. Just use htmlentities for the files output before they are sent to the browser:

Code: Select all

 nano /usr/local/vesta/web/list/web-log/index.php

There, find the line:

Code: Select all

echo $file . "\n";

and change it for:

Code: Select all

echo htmlentities($file) . "\n";

Now, I'm concern about others security breaches as this that we have not found yet. :( I know it is a long process...

What other things have you done to harden your VestaCP installation?

I'm implementing a way offer two factors authentication (password + SMS code). I hope to have something working soon. This will be a nice add-in for VestaCP.

I hope this help others to prevent nasty situations with their panels.

Regards

[jonn]

can you add a pull request
https://github.com/serghey-rodin/vesta/pulls

[skurudo]

can you add a pull request

Already is.. and will be in new version:
https://github.com/serghey-rodin/vesta/pull/639

[skamasle]

can you add a pull request

Already is.. and will be in new version:
https://github.com/serghey-rodin/vesta/pull/639

Is critical bug, you need put micro updates to fix this, so there are a lot of vestacp there whit critical bug.

What is the estimated time to new versión ?

[skurudo]

Is critical bug, you need put micro updates to fix this, so there are a lot of vestacp there whit critical bug.

It's will be possible after this version and after code refactoring.

What is the estimated time to new versión ?

Refactoring - done,
now bugs and test and here we go.
I think it's about two weeks.

[skamasle]

Is critical bug, you need put micro updates to fix this, so there are a lot of vestacp there whit critical bug.

It's will be possible after this version and after code refactoring.

What is the estimated time to new versión ?

Refactoring - done,
now bugs and test and here we go.
I think it's about two weeks.

Code refactoring :/ a lot of changes may be ?

So its posible some of my scripts dont working ( cpanel importer )

Can I test your new versión ? maybe be a betatester ?

[skurudo]

Code refactoring :/ a lot of changes may be ?

Well, skid say - works a much faster.

So its posible some of my scripts dont working ( cpanel importer )
Can I test your new versión ? maybe be a betatester ?

Dunno, sorry.
It's needs to test, but don't think so.
Sorry, there no beta-testers yet, we think about beta-practice, but a bit later.

[skamasle]

Ok dont worry, I wait new version :D

[skurudo]

FIX
https://github.com/serghey-rodin/vesta/pull/639