aaPanel 6.6.6 - Privilege Escalation & Remote Code Execution (Authenticated)

🗓️ 16 Oct 2020 00:00:00Reported by Ünsal Furkan HaraniType

exploitdb🔗 www.exploit-db.com👁 578 Views

aaPanel 6.6.6 - Authenticated Privilege Escalation & Remote Code Execution. Exploit allows admin to gain root access via crontab.py with reverse shell code. Vendor: https://www.aapanel.com

Reporter	Title	Published	Views	Family All 12
GithubExploit	Exploit for Argument Injection in Aapanel	18 Jun 202011:04	–	githubexploit
CNVD	aaPanel Remote Code Execution Vulnerability	19 Jun 202000:00	–	cnvd
CVE	CVE-2020-14421	18 Jun 202012:51	–	cve
Cvelist	CVE-2020-14421	18 Jun 202012:51	–	cvelist
EUVD	EUVD-2020-6560	7 Oct 202500:30	–	euvd
NVD	CVE-2020-14421	18 Jun 202013:15	–	nvd
OSV	CVE-2020-14421	18 Jun 202013:15	–	osv
Packet Storm	aaPanel 6.6.6 Privilege Escalation	16 Oct 202000:00	–	packetstorm
Packet Storm	📄 aaPanel 7.x.x Remote Command Execution	19 Sep 202500:00	–	packetstorm
Prion	Code injection	18 Jun 202013:15	–	prion

# Exploit Title: [aaPanel 6.6.6 - Authenticated Privilege Escalation]
# Google Dork: []
# Date: [04.05.2020]
# Exploit Author: [Ünsal Furkan Harani (Zemarkhos)]
# Vendor Homepage: [https://www.aapanel.com/](https://www.aapanel.com/)
# Software Link: [https://github.com/aaPanel/aaPanel](https://github.com/aaPanel/aaPanel)
# Version: [6.6.6] (REQUIRED)
# Tested on: [Linux ubuntu 4.4.0-131-generic #157-Ubuntu SMP Thu Jul 12 15:51:36 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux]
# CVE : [CVE-2020-14421]

if you are logged was admin;

1- go to the crontab

2- select shell script and paste your reverse shell code

3- click execute button and you are now root.

because crontab.py running with root privileges.

Remote Code Execution

https://github.com/jenaye/aapanel

16 Oct 2020 00:00Current

7.1High risk

Vulners AI Score7.1

CVSS 3.17.2

CVSS 29

EPSS0.09449

aaPanel 6.6.6 - Privilege Escalation &amp; Remote Code Execution (Authenticated)

aaPanel 6.6.6 - Privilege Escalation & Remote Code Execution (Authenticated)