Quantum Secular Labs / Blog / Advisories

CVE-2018-1000884: Vestacp Vesta Control Panel: Authentication bypass

CVE-2018-1000884 is rated critical with a CVSS v3.0 base score of 9.8 and NVD lists Vestacp Vesta Control Panel as the affected product. Per its scoring, it can be exploited over the network, without authentication, without any user interaction. The scored impact on confidentiality, integrity and availability is the highest available.

Vulnerability description

Vesta CP version Prior to commit f6f6f9cfbbf2979e301956d1c6ab5c44386822c0 -- any release prior to 0.9.8-18 contains a CWE-208 / Information Exposure Through Timing Discrepancy vulnerability in Password reset code -- web/reset/index.php, line 51 that can result in Possible to determine password reset codes, attacker is able to change administrator password. This attack appear to be exploitable via Unauthenticated network connectivity. This vulnerability appears to have been fixed in After commit f6f6f9cfbbf2979e301956d1c6ab5c44386822c0 -- release version 0.9.8-19.

Severity breakdown

CVSS v3.0 9.8: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Attack vector: Network. Exploitable remotely over the network, with no need for local or physical access.
  • Attack complexity: Low. No special conditions; the attack can be repeated reliably.
  • Privileges required: None. No account or prior access is needed.
  • User interaction: None. No action from any user is needed.
  • Scope: Unchanged. Impact stays within the vulnerable component.
  • Confidentiality impact: High. Total loss of confidentiality; sensitive data can be fully disclosed.
  • Integrity impact: High. Total loss of integrity; data or system state can be fully modified.
  • Availability impact: High. Total loss of availability; the component can be shut down.

Underlying weakness

CWE-203: Observable Discrepancy

The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.

Affected products

  • Vestacp Vesta Control Panel: before 0.9.8-18

References