{"vulnerability": "cve-2021-28379", "sightings": [{"uuid": "feadaee0-d31a-4859-a5db-7b610455967e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28379", "type": "seen", "source": "https://t.me/cibsecurity/24886", "content": "\u203c CVE-2021-28379 \u203c\n\nweb/upload/UploadHandler.php in Vesta Control Panel (aka VestaCP) through 0.9.8-27 and myVesta through 0.9.8-26-39 allows uploads from a different origin.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-03-15T11:28:30.000000Z"}, {"uuid": "2d0c8124-db64-4544-ae3e-b7fb0ab76efc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28379", "type": "seen", "source": "https://t.me/hacking_Attack/1478", "content": "Exploit Collector\nVestaCP 0.9.8 Cross Site Request Forgery\n\nhttps://1.bp.blogspot.com/-luFAqsulr64/WWlvFAfKXLI/AAAAAAAAILI/M2y6qJlcju8Kpq9V68KpSF2h6FJoaSeWACLcBGAs/s1600/h135.png \nVestaCP version 0.9.8 suffers from a cross site request forgery that can be leveraged to add remote ssh access.\n\nMD5 | 0cd72aff04a0cdb12d80f6b96cd818ed\n\nDownload\n# Exploit Title: VestaCP 0.9.8 - File Upload CSRF\n# Exploit Author: Fady Othman \n# Date: 16-03-2021\n# Vendor Homepage: https://vestacp.com/\n# Software Link: https://github.com/myvesta/vesta\n# Version: Vesta Control Panel (aka VestaCP) through 0.9.8-27 and myVesta through 0.9.8-26-39\n# CVE ID: CVE-2021-28379\n# Patch: https://github.com/myvesta/vesta/commit/3402071e950e76b79fa8672a1e09b70d3860f355\n\n## Description\nI found that the checks performed by the upload functionality are insufficient, the upload functionality is vulnerable to CSRF, in addition it allows uploading files and creating folders under \"/tmp\" and under the home folder (usually \"/home/admin\"), the later is the one that is important for this exploit to work.\n\nI was able to use this to create a \".ssh\" folder in the admin home and upload \"authorized_keys\" file which allowed me to access the server later as \"admin\" using SSH.\n\nSince this relies on a *CSRF* the admin has to visit a link, please note that *sshd* is already installed by *VestaCP* when using the default installation script so no need to install it, also please note that files can be replaced so even if the admin has already added \"authorized_keys\" file, it will be replaced with the attacker's file.\n\nAffected endpoint: \"/upload/index.php\", i.e. \"/upload/index.php?dir=/home/admin/.ssh/\"\n\n## Steps to reproduce.\n1. Install the latest version of VestaCP in your machine by following the instructions at https://vestacp.com/install/.\n2. Login as the admin in Firefox, then open \"exploit.html\".\n3. ssh into the machine using 'ssh -i id_rsa admin@victimmachine', now you have access as admin.\n\n# exploit.html \n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:02:50.583523Z"}, {"uuid": "de50e684-6cdb-4776-a35e-d3b166baf8b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28379", "type": "seen", "source": "https://t.me/hacking_Attack/1478", "content": "Exploit Collector\nVestaCP 0.9.8 Cross Site Request Forgery\n\nhttps://1.bp.blogspot.com/-luFAqsulr64/WWlvFAfKXLI/AAAAAAAAILI/M2y6qJlcju8Kpq9V68KpSF2h6FJoaSeWACLcBGAs/s1600/h135.png \nVestaCP version 0.9.8 suffers from a cross site request forgery that can be leveraged to add remote ssh access.\n\nMD5 | 0cd72aff04a0cdb12d80f6b96cd818ed\n\nDownload\n# Exploit Title: VestaCP 0.9.8 - File Upload CSRF\n# Exploit Author: Fady Othman \n# Date: 16-03-2021\n# Vendor Homepage: https://vestacp.com/\n# Software Link: https://github.com/myvesta/vesta\n# Version: Vesta Control Panel (aka VestaCP) through 0.9.8-27 and myVesta through 0.9.8-26-39\n# CVE ID: CVE-2021-28379\n# Patch: https://github.com/myvesta/vesta/commit/3402071e950e76b79fa8672a1e09b70d3860f355\n\n## Description\nI found that the checks performed by the upload functionality are insufficient, the upload functionality is vulnerable to CSRF, in addition it allows uploading files and creating folders under \"/tmp\" and under the home folder (usually \"/home/admin\"), the later is the one that is important for this exploit to work.\n\nI was able to use this to create a \".ssh\" folder in the admin home and upload \"authorized_keys\" file which allowed me to access the server later as \"admin\" using SSH.\n\nSince this relies on a *CSRF* the admin has to visit a link, please note that *sshd* is already installed by *VestaCP* when using the default installation script so no need to install it, also please note that files can be replaced so even if the admin has already added \"authorized_keys\" file, it will be replaced with the attacker's file.\n\nAffected endpoint: \"/upload/index.php\", i.e. \"/upload/index.php?dir=/home/admin/.ssh/\"\n\n## Steps to reproduce.\n1. Install the latest version of VestaCP in your machine by following the instructions at https://vestacp.com/install/.\n2. Login as the admin in Firefox, then open \"exploit.html\".\n3. ssh into the machine using 'ssh -i id_rsa admin@victimmachine', now you have access as admin.\n\n# exploit.html \n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-02T01:03:26.316375Z"}]}