Threats affecting pkg:github/hestiacp

HestiaCP versions before 1.9.5 contain a stored cross-site scripting (XSS) vulnerability. Authenticated low-privilege users can inject arbitrary HTML by creating a DNS record with a crafted value containing a double-quote and script payload. The vulnerability arises because the application does not properly encode the DNS record value when rendering it into an HTML attribute, allowing script execution in the browsers of users who view the DNS record list, including administrators. This issue is fixed in version 1.9.5.

HestiaCP versions prior to 1.9.5 contain an authenticated OS command injection vulnerability. This flaw allows low-privilege authenticated users to execute arbitrary commands as root by injecting a single-quote character into unvalidated DNS record types. The vulnerability arises from insufficient input validation combined with unsafe eval-based parsing, enabling full root code execution during DNS record creation. The issue is fixed in version 1.9.5.

HestiaCP versions 1.2.0 through 1.9.4 contain an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass authentication security controls by supplying an arbitrary IP address in the CF-Connecting-IP HTTP header without verifying the request originated from Cloudflare's network. Attackers can exploit this to circumvent fail2ban brute-force protection, bypass per-user IP allowlists, and poison authentication audit logs by spoofing trusted IP addresses on each request.

HestiaCP versions 1.9.0 through 1.9.4 contain a deserialization vulnerability in the web terminal component caused by a session format mismatch between PHP and Node.js that allows unauthenticated remote attackers to achieve root-level code execution. Attackers can inject crafted data into HTTP headers that are processed by the PHP session handler but incorrectly deserialized by the Node.js web terminal component as trusted session values, resulting in arbitrary command execution on systems with the web terminal feature enabled.