ZesleCP Remote Code Execution Vulnerability in FTP Account Creation

An authenticated remote code execution vulnerability exists in ZesleCP version 3.1.9. This vulnerability allows attackers to create FTP accounts embedded with shell injection payloads. By exploiting the FTP account creation endpoint, attackers can inject reverse shell commands that establish a network connection to a specified listening host.

Impact

Exploitation of this vulnerability allows for authenticated remote code execution on the server where ZesleCP is installed.

Reproduction

To reproduce this vulnerability, log into the ZesleCP control panel as a user with FTP account creation privileges. Once logged in, navigate to the FTP account creation section. Inject a reverse shell command into the FTP password field, using a payload that connects back to a listener on the attacker's machine. After the FTP account is created, the injected command will be executed, establishing a reverse shell connection.