Authorization Bypass in HestiaCP

HestiaCP versions before 1.10.5 are affected by an authorization bypass vulnerability that enables non-ROOT_USER administrators to perform write operations by impersonating the system's protected ROOT_USER account. The vulnerability stems from a flaw in the application's permission logic where the read-only flag is improperly validated when using the 'loginas' parameter. An attacker with administrative access to a sub-account can exploit this by sending a crafted POST request to the '/add/cron/' endpoint. This action causes the underlying 'crond' service to execute the requested commands with the privileges associated with the protected administrative system account, potentially leading to full system compromise. Defenders should prioritize updating to version 1.10.5 or later to remediate this flaw.

Attack Chain

1. Attacker gains access to a low-privilege administrator sub-account within the HestiaCP control panel.
2. Attacker crafts a request utilizing the 'loginas' parameter to assume the context of the ROOT_USER.
3. Attacker targets the '/add/cron/' API endpoint to initiate a task creation request.
4. The application fails to validate the read-only restriction for the session context.
5. The unauthorized write operation is processed, and the cron job is persisted to the system configuration.
6. The 'crond' daemon schedules the task based on the malicious input.
7. The system executes the arbitrary command with ROOT_USER privileges.

Impact

Successful exploitation allows a restricted administrator to elevate their privileges to the ROOT_USER level and execute arbitrary system commands. This impacts the confidentiality, integrity, and availability of the hosting server, potentially affecting all hosted websites and databases managed by the HestiaCP instance.

Recommendation

• Patch all HestiaCP instances to version 1.10.5 or later immediately.
• Audit web server logs for suspicious POST requests to the '/add/cron/' endpoint originating from non-root administrative accounts.
• Review all scheduled cron jobs on HestiaCP servers for unauthorized or unexpected entries created by sub-administrators.