Horizon Alert
Summary of the vulnerability and why it matters
This issue in HestiaCP's web terminal could allow an unauthenticated attacker to run commands on your server with root privileges. It happens when specially crafted data is sent in HTTP headers, leading to the system executing unintended code. Teams should pay attention because this vulnerability grants full control over the affected system.
- Enables root-level code execution.
- Attack is remote and unauthenticated.
- Affects systems with the web terminal enabled.
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP headers to a vulnerable HestiaCP server. The server's PHP session handler will process these headers, but the Node.js web terminal component will misinterpret them as trusted session data, leading to the execution of arbitrary commands with root privileges.
- Target vulnerable web terminal.
- Inject data via HTTP headers.
- Requires web terminal enabled.
Live Threat
Current exploitation, exposure, and threat context
Attackers are likely to weaponize this vulnerability due to its critical impact and ease of exploitation. The ability to achieve root-level code execution without authentication on a web-facing service presents a significant opportunity for attackers to compromise servers. While there is no public exploit code available yet, the clear vulnerability description and associated proof-of-concept details make it a prime target for exploit development.
- Unauthenticated remote code execution.
- Web terminal component is externally accessible.
- Root-level impact is highly desirable.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Teams should prioritize discovering and assessing HestiaCP installations with the web terminal feature enabled, as this critical vulnerability allows unauthenticated remote code execution. Focus on identifying any signs of compromise by reviewing logs for suspicious HTTP header activity and command execution attempts, especially on systems with the web terminal component. If exploitation is suspected, immediately isolate affected services to prevent further lateral movement or data exfiltration.
- Disable the web terminal feature.
- Monitor for suspicious network traffic.
- Update HestiaCP to a patched version.
