A critical vulnerability in DirectAdmin v1.680 allows unauthenticated attackers to perform interface spoofing, posing a significant risk of credential harvesting.

The vulnerability is an input manipulation flaw that allows an unauthenticated attacker to inject arbitrary content into the login page through a crafted GET request. This allows for the replacement of legitimate interface elements with attacker-controlled data.

The ability to manipulate the login interface presents a severe risk of credential theft through phishing or spoofing attacks. Given the CVSS score of 8.2, this vulnerability is considered high severity, as it facilitates unauthorized interaction with the authentication portal without requiring valid user credentials. This could lead to widespread account compromise and unauthorized access to administrative functions.

Immediate Action: Administrators should immediately restrict access to the DirectAdmin login interface using network-level controls until a vendor-supplied patch is identified and applied.

Proactive Monitoring: Review web server access logs for anomalous GET requests targeting the login endpoint, specifically looking for unusual parameters or payloads.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious or malformed GET requests that attempt to modify interface content.

Public Exploit Available: Unknown.

Given the potential for credential harvesting via interface replacement, this vulnerability warrants immediate attention. Organizations should prioritize restricting access to the management interface and monitor for any signs of unauthorized page modifications until a formal patch is released by the vendor.