Summary
Hestia Control Panel contains a shell configuration injection flaw that lets a low-privileged authenticated panel user with a web domain influence a user's web configuration. When the Search feature processes the forged configuration, the root-privileged search helper may use an attacker-controlled PATH, allowing arbitrary code execution with root privileges.
Hestia Control Panel contains a shell configuration injection flaw that lets a low-privileged authenticated panel user with a web domain influence a user's web configuration. When the Search feature processes the forged configuration, the root-privileged search helper may use an attacker-controlled PATH, allowing arbitrary code execution with root privileges.
Affected context
The vulnerability affects Hestia Control Panel deployments in which:
- An authenticated low-privileged panel user can manage a web domain
- A custom document-root value is written to the user's web.conf file
- Single quotes in that value are not escaped before configuration generation
- The root-privileged user-search workflow parses the resulting key-value data
- The search helper invokes column without an absolute path
Exploitation depends on the vulnerable configuration-writing and search-processing paths being available in the deployment.
The vulnerability affects Hestia Control Panel deployments in which:
- An authenticated low-privileged panel user can manage a web domain
- A custom document-root value is written to the user's web.conf file
- Single quotes in that value are not escaped before configuration generation
- The root-privileged user-search workflow parses the resulting key-value data
- The search helper invokes column without an absolute path
Exploitation depends on the vulnerable configuration-writing and search-processing paths being available in the deployment.
Exploit preconditions
- Attack surface: Authenticated Hestia Control Panel web-domain management and the Search feature
- Required access: A low-privileged authenticated panel account with a web domain
- Trigger point: Processing of the affected user object when the ordinary Search feature is invoked
- Why exploitation is possible: Insufficient escaping permits configuration-field injection, while the parser accepts reserved shell-variable names and the privileged helper relies on PATH-based command resolution
- Attack surface: Authenticated Hestia Control Panel web-domain management and the Search feature
- Required access: A low-privileged authenticated panel account with a web domain
- Trigger point: Processing of the affected user object when the ordinary Search feature is invoked
- Why exploitation is possible: Insufficient escaping permits configuration-field injection, while the parser accepts reserved shell-variable names and the privileged helper relies on PATH-based command resolution
Why this happens
The underlying issue combines inadequate shell-data escaping with unsafe handling of parsed configuration values. A custom document-root value containing an unescaped single quote can alter the structure of the generated web.conf data, allowing an additional PATH field to be introduced.
The non-evaluating parser reduces direct evaluation risk but still permits reserved shell-variable names to overwrite the process environment. The root-privileged helper then invokes a command without an absolute path, allowing the modified PATH to influence executable selection. This behavior maps primarily to CWE-427: Uncontrolled Search Path Element, with related aspects of CWE-88: Improper Neutralization of Argument Delimiters in a Command and CWE-94: Improper Control of Code Generation.
The underlying issue combines inadequate shell-data escaping with unsafe handling of parsed configuration values. A custom document-root value containing an unescaped single quote can alter the structure of the generated web.conf data, allowing an additional PATH field to be introduced.
The non-evaluating parser reduces direct evaluation risk but still permits reserved shell-variable names to overwrite the process environment. The root-privileged helper then invokes a command without an absolute path, allowing the modified PATH to influence executable selection. This behavior maps primarily to CWE-427: Uncontrolled Search Path Element, with related aspects of CWE-88: Improper Neutralization of Argument Delimiters in a Command and CWE-94: Improper Control of Code Generation.
Potential impact
- An authenticated low-privileged user may execute arbitrary code with root privileges
- The Hestia control-panel host could be fully compromised
- Hosting accounts, websites, credentials, and stored data could be accessed or modified
- Additional services or tenant environments may be affected
- The compromised host could be used for persistence, data theft, or lateral movement
- An authenticated low-privileged user may execute arbitrary code with root privileges
- The Hestia control-panel host could be fully compromised
- Hosting accounts, websites, credentials, and stored data could be accessed or modified
- Additional services or tenant environments may be affected
- The compromised host could be used for persistence, data theft, or lateral movement
General mitigation guidance
Mitigation generally focuses on preserving strict trust boundaries between user-controlled values, generated shell configuration, and privileged processes.
Common defensive patterns include:
- Apply context-appropriate escaping and strict allowlist validation to document-root and other user-controlled values
- Reject control characters, shell metacharacters, malformed delimiters, and reserved environment-variable names
- Parse configuration into a constrained schema rather than assigning arbitrary parsed keys to shell variables
- Treat configuration fields as data and avoid shell evaluation or environment mutation based on untrusted input
- Invoke system utilities using absolute paths or a fixed, trusted execution environment
- Run privileged helpers with minimal permissions and a restricted environment
- Separate user-owned configuration from root-owned control-plane state and enforce appropriate file permissions
Mitigation generally focuses on preserving strict trust boundaries between user-controlled values, generated shell configuration, and privileged processes.
Common defensive patterns include:
- Apply context-appropriate escaping and strict allowlist validation to document-root and other user-controlled values
- Reject control characters, shell metacharacters, malformed delimiters, and reserved environment-variable names
- Parse configuration into a constrained schema rather than assigning arbitrary parsed keys to shell variables
- Treat configuration fields as data and avoid shell evaluation or environment mutation based on untrusted input
- Invoke system utilities using absolute paths or a fixed, trusted execution environment
- Run privileged helpers with minimal permissions and a restricted environment
- Separate user-owned configuration from root-owned control-plane state and enforce appropriate file permissions
How teams detect issues like this
Detection approaches may include:
- Static analysis for shell assignments derived from user-controlled values without context-specific escaping
- Searches for dynamic PATH assignments, exported parsed variables, and command invocations lacking absolute paths
- Code review of configuration serializers and key-value parsers for acceptance of reserved variable names
- Tests using delimiter, quote, metacharacter, and unexpected-key inputs to verify schema and escaping behavior
- Runtime monitoring for unexpected executable resolution, privileged helper behavior, or child processes launched from user-writable directories
- Policy enforcement requiring allowlisted command paths and preventing privileged services from inheriting mutable search paths
Automated static-analysis and secure-code-review tools may help identify these patterns during development.
Detection approaches may include:
- Static analysis for shell assignments derived from user-controlled values without context-specific escaping
- Searches for dynamic PATH assignments, exported parsed variables, and command invocations lacking absolute paths
- Code review of configuration serializers and key-value parsers for acceptance of reserved variable names
- Tests using delimiter, quote, metacharacter, and unexpected-key inputs to verify schema and escaping behavior
- Runtime monitoring for unexpected executable resolution, privileged helper behavior, or child processes launched from user-writable directories
- Policy enforcement requiring allowlisted command paths and preventing privileged services from inheriting mutable search paths
Automated static-analysis and secure-code-review tools may help identify these patterns during development.
