Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2018-25117— VestaCP Debian Installer Malicious Backdoor Supply Chain Compromise

Quick assessment

Affected
Vesta Control Panel (CP)
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Vesta Control Panel（VestaCP）是一个开源的虚拟主机控制面板。 Vesta Control Panel ee03eff版本及之前版本存在安全漏洞，该漏洞源于嵌入恶意代码，可能导致供应链攻击和管理员凭据泄露。

AI Predicted 9.8 Difficulty: Trivial EPSS 0.41% · P34

Affected Version Matrix 1

VendorProduct Version RangeStatus
Vesta Control Panel (CP) a3f0fa1501d424477786e3e7150bb05c0b99518f< ee03eff016e03cb76fac7ae3a0f9d1ef0f8ee35b affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2018-25117

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
VestaCP Debian Installer Malicious Backdoor Supply Chain Compromise
Source: CVE Program / CVE List V5
Vulnerability Description
VestaCP commit a3f0fa1 (2018-05-31) up to commit ee03eff (2018-06-13) contain embedded malicious code that resulted in a supply-chain compromise. New installations created from the compromised installer since at least May 2018 were subject to installation of Linux/ChachaDDoS, a multi-stage DDoS bot that uses Lua for second- and third-stage components. The compromise leaked administrative credentials (base64-encoded admin password and server domain) to an external URL during installation and/or resulted in the installer dropping and executing a DDoS malware payload under local system privileges. Compromised servers were subsequently observed participating in large-scale DDoS activity. Vesta acknowledged exploitation in the wild in October 2018.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
内嵌的恶意代码
Source: CVE Program / CVE List V5
Vulnerability Title
Vesta Control Panel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Vesta Control Panel（VestaCP）是一个开源的虚拟主机控制面板。 Vesta Control Panel ee03eff版本及之前版本存在安全漏洞，该漏洞源于嵌入恶意代码，可能导致供应链攻击和管理员凭据泄露。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Vesta Control Panel (CP) a3f0fa1501d424477786e3e7150bb05c0b99518f ~ ee03eff016e03cb76fac7ae3a0f9d1ef0f8ee35b -

II. Public POCs for CVE-2018-25117

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2018-25117

请登录查看更多情报信息。

Vendor Advisories for CVE-2018-25117 (1)

IV. Related Vulnerabilities

Same weakness: CWE-506

V. Comments for CVE-2018-25117

No comments yet

Leave a comment