CVE-2020-10808

Vulnerability

Vesta Control Panel (VestaCP) through version 0.9.8-26 suffers from a command injection vulnerability in the schedule/backup Backup Listing Endpoint [2]. The issue arises because the application executes bash scripts via exec() calls using user-controlled input without proper sanitization beyond escapeshellarg() in some cases, but the backup listing endpoint processes filenames that are not sanitized at all [1][2]. An attacker must first be able to create a crafted filename on the server—this can be achieved via FTP by uploading a file with a name containing shell metacharacters, such as renaming .bash_logout to .bash_logout' followed by $() or backticks [2]. The vulnerable version is 0.9.8-26 and earlier [1].

Exploitation

An attacker needs authenticated access to VestaCP (as a user with FTP and web panel credentials) and the ability to write files via FTP [1]. The attack sequence is: 1) Authenticate to the FTP service and upload a file with a crafted filename that includes shell metacharacters, such as ;id; or backtick commands. 2) Trigger the backup listing endpoint via the web interface, which reads the filename and passes it unsanitized into a shell command. 3) The payload is executed as part of the backup listing process, deploying a first-stage stager (e.g., a Python meterpreter). 4) The stager then fetches a second-stage payload (e.g., a shell script via curl) and executes it, achieving remote code execution [1][2]. The Metasploit module automates these steps, with a delay of up to 5 minutes for the backup process to trigger [1].

Impact

Successful exploitation allows an authenticated attacker to execute arbitrary operating system commands as the admin user (who has sudo privileges) on the VestaCP server [2]. This leads to full compromise of the VestaCP instance and the underlying system, including data disclosure, modification, and denial of service, effectively achieving remote code execution (RCE) with root-level privileges [1][2].

Mitigation

As of the publication date (2020-03-22), no official patch was available for VestaCP 0.9.8-26 [1][2]. Users are advised to restrict access to the VestaCP web interface and FTP service to trusted networks only, and to monitor for unauthorized file uploads. The vendor has not released a fixed version; updating to a later version if available is recommended. This vulnerability has been added to the Metasploit Framework (exploit/linux/http/vestacp_exec), indicating active exploitation risk [1].