VestaCP Cross-Site Scripting Vulnerability in IP Interface Configuration

A stored cross-site scripting vulnerability has been identified in VestaCP versions prior to 0.9.8-25. This issue resides in the IP interface configuration, where attackers can inject malicious scripts. The vulnerability is exploited by sending a crafted POST request to the add/ip/ endpoint, targeting the 'v_interface' parameter with a stored XSS payload.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Reproduction

To reproduce this vulnerability, send a POST request to the add/ip/ endpoint on the VestaCP interface. Include a payload in the 'v_interface' parameter that contains a script, such as a simple alert script. Once the request is processed, the injected script will be executed, demonstrating the cross-site scripting vulnerability.