Threats affecting pkg:github/hestiacp/hestiacp

HestiaCP versions before 1.10.5 have an authorization bypass vulnerability that allows non-ROOT_USER administrators to perform write actions by impersonating the protected ROOT_USER account. This occurs because the read-only flag is not checked when using the loginas parameter to POST to /add/cron/, enabling attackers to run commands as the protected administrator's system account.

HestiaCP before 1.9.5 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject arbitrary HTML by creating a DNS record with a double-quote followed by a script payload in the value field. The application fails to apply htmlspecialchars() encoding to the DNS record value field rendered into the data-sort-value HTML attribute in list_dns_rec.php, allowing the payload to execute in the browser of any user who views the DNS record list, including administrators.

HestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability that allows low-privilege authenticated users to execute arbitrary commands as root by injecting a single-quote character into unvalidated DNS record types. Attackers can exploit insufficient input validation in is_dns_record_format_valid() combined with unsafe eval-based parsing in update_domain_zone() to prematurely close a variable assignment string and achieve full root code execution on the underlying host in a single DNS record creation step.