Page 1 of 1

Vesta Control Panel 0.9.8-16 - Local Privilege Escalation

Posted: Fri Jan 06, 2017 1:51 am
by mainh
Hello,
So it seem's like the current release of VestaCP is vulnerable to root escalation, which is a bit of security concern as if one would compile a certain file and then execute a certain command from SSH, they can easily take over root permissions on the server.

The full report of said exploit is available here:
https://www.exploit-db.com/exploits/40953/

I suspect that this issue isn't all that hard to patch as it's only an input that's not sanitized, but I will give it a go myself in the meanwhile to get a solution to the issue.

Re: Vesta Control Panel 0.9.8-16 - Local Privilege Escalation

Posted: Fri Jan 06, 2017 5:27 am
by joem
mainh wrote:Hello,
So it seem's like the current release of VestaCP is vulnerable to root escalation, which is a bit of security concern as if one would compile a certain file and then execute a certain command from SSH, they can easily take over root permissions on the server.

The full report of said exploit is available here:
https://www.exploit-db.com/exploits/40953/

I suspect that this issue isn't all that hard to patch as it's only an input that's not sanitized, but I will give it a go myself in the meanwhile to get a solution to the issue.

This exploit has been patched https://github.com/serghey-rodin/vesta/ ... be88ca5e64
bin/v-get-web-domain-value wrote: +# Say goodbye
+echo "This script is not used anymore"
+exit
+