CyberRota Analysis
AI-GeneratedHestiaCP versions prior to 1.9.5 are vulnerable to an authenticated OS command injection, allowing low-privilege users to execute arbitrary commands with root privileges by manipulating DNS records. This vulnerability arises from inadequate input validation and unsafe parsing methods, enabling attackers to gain full control over the host system. Organizations using HestiaCP should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
HestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability that allows low-privilege authenticated users to execute arbitrary commands as root by injecting a single-quote character into unvalidated DNS record types. Attackers can exploit insufficient input validation in is_dns_record_format_valid() combined with unsafe eval-based parsing in update_domain_zone() to prematurely close a variable assignment string and achieve full root code execution on the underlying host in a single DNS record creation step.
Related CVEs
Other vulnerabilities affecting the same vendor(s)