CVE-2021-46850

Vesta Control Panel <0.9.8-26-43 and <0.9.8-26 command injection via v_sftp_license parameter

• CVSS 7.2
• CWE-88
• Input Validation and Sanitization
• Remote

myVesta Control Panel before 0.9.8-26-43 and Vesta Control Panel before 0.9.8-26 are vulnerable to command injection. An authenticated and remote administrative user can execute arbitrary commands via the v_sftp_license parameter when sending HTTP POST requests to the /edit/server endpoint.

CVE

CVE-2021-46850

CWE

CWE-88

CVSS base score

7.2

Published

2022-10-24

OWASP

A03 Injection

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Command Injection

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update Vesta Control Panel to version 0.9.8-26-43 or higher.

from flask import Flask, request
import subprocess

app = Flask(__name__)

@app.route('/edit/server', methods=['POST'])
def edit_server():
    """Vulnerable function that demonstrates the security issue."""
    # VULNERABLE: This code is susceptible to command injection
    v_sftp_license = request.form.get('v_sftp_license')

    result = subprocess.run(['some_command', v_sftp_license], capture_output=True, text=True)

    return result.stdout, 200

if __name__ == '__main__':
    app.run()

from flask import Flask, request
import subprocess
import re

app = Flask(__name__)

BLACKLIST_PATTERN = re.compile(r'[;&|`><]')

@app.route('/edit/server', methods=['POST'])
def edit_server():
    """Secure function that fixes the vulnerability."""
    # SECURE: This version prevents command injection
    v_sftp_license = request.form.get('v_sftp_license')

    if BLACKLIST_PATTERN.search(v_sftp_license):
        return "Invalid input: blacklisted characters detected", 400

    result = subprocess.run(['some_command', v_sftp_license], capture_output=True, text=True)

    return result.stdout, 200

if __name__ == '__main__':
    app.run()

@misc{vaitp:cve202146850,
  title        = {{Vesta Control Panel <0.9.8-26-43 and <0.9.8-26 command injection via v_sftp_license parameter}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2022},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2021-46850},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2021-46850/}}
}