CVE-2020-10808 : Security Advisory and Response

Vesta Control Panel (VestaCP) through 0.9.8-26 allows Command Injection via the schedule/backup Backup Listing Endpoint. The attacker must be able to create a crafted filename on the server, as demonstrated by an FTP session that renames .bash_logout to a .bash_logout' substring followed by shell metacharacters.

Understanding CVE-2020-10808

What is CVE-2020-10808?

CVE-2020-10808 is a vulnerability in Vesta Control Panel (VestaCP) that enables Command Injection through the schedule/backup Backup Listing Endpoint.

The Impact of CVE-2020-10808

This vulnerability allows an attacker to execute arbitrary commands on the server by manipulating filenames, potentially leading to unauthorized access and data breaches.

Technical Details of CVE-2020-10808

Vulnerability Description

The vulnerability in VestaCP allows for Command Injection via the Backup Listing Endpoint, requiring the attacker to create a specific filename on the server.

Affected Systems and Versions

Product: Vesta Control Panel (VestaCP)
Versions affected: through 0.9.8-26

Exploitation Mechanism

The attacker can exploit this vulnerability by renaming files on the server, such as .bash_logout, with crafted filenames containing shell metacharacters.

Mitigation and Prevention

Immediate Steps to Take

Disable access to the Backup Listing Endpoint if not essential
Implement strict file upload restrictions
Regularly monitor and audit file system changes

Long-Term Security Practices

Conduct regular security assessments and penetration testing
Educate users on secure file naming conventions and practices

Patching and Updates

Apply the latest patches and updates provided by VestaCP to address this vulnerability