Zero-day vulnerability in Vesta Control Panel
Improper authentication
The vulnerability was used to compromise hosting servers. The attack was reportedly performed from IP addresses, located in China.
This vulnerability triggered an outage of Digitalocean in NYC regions.
Vulnerability details
Advisory: SB2018040905 - Authentication bypass in Vesta Control Panel
Vulnerable component: Vesta Control Panel
CVE-ID:
CVSSv3 score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H/RL:O/RC:C
CWE-ID: CWE-287 - Improper Authentication
Description:
The vulnerability allows a remote attacker to bypass authentication checks and gain full access to the affected system.
The vulnerability exists due to import validation of the authentication credentials in Vesta CP management interface. A remote unauthenticated attacker can send a specially crafted HTTP request to Vesta CP management interface, bypass authentication and gain full control over the affected server.
Note: this vulnerability is being actively exploited in the wild.
The attack was reportedly performed from IP addresses, located in China. The attackers created a file "/etc/cron.hourly/gcc.sh" on infected systems. If this file is present on your server, it means that you system has been compromised.