Listen to this Post
CVE-2025-30008 is a stored cross-site scripting (XSS) vulnerability affecting Hestia Control Panel (HestiaCP) versions prior to 1.9.5. The flaw resides in the DNS record management interface, specifically within the `list_dns_rec.php` file. Authenticated users with low privileges can inject arbitrary HTML and JavaScript by creating a DNS record with a malicious payload in the value field.
The root cause is the application’s failure to properly sanitize user-supplied input before rendering it into HTML attributes. When a DNS record is created, the value entered by the user is stored in the database without adequate filtering. Later, when the DNS record list is displayed, the application renders the value into a `data-sort-value` HTML attribute without applying `htmlspecialchars()` encoding. This allows an attacker to break out of the attribute context by using a double-quote character, followed by a script payload.
For example, an attacker could create a DNS record with a value like `” onmouseover=”alert(‘XSS’)` or "><script>alert('XSS')</script>. When an administrator or any other user views the DNS record list, the payload is executed in their browser. The stored nature of the vulnerability means the malicious script persists until the DNS record is manually deleted.
The impact is significant because any user viewing the affected DNS records, including administrators with elevated privileges, becomes a potential victim. Attackers can leverage this to steal session cookies, perform actions on behalf of the victim, deface the interface, or redirect users to malicious sites. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation) and has a CVSS v4.0 base score of 5.1 (Medium).
The issue was discovered by Djibril Mounkoro and publicly disclosed on July 10, 2026. The vendor addressed the flaw in version 1.9.5 by implementing proper output encoding mechanisms. Organizations using older versions are strongly advised to upgrade immediately. Temporary mitigations include disabling DNS record creation for low-privilege users or applying custom input validation filters.
DailyCVE Form:
Platform: Hestia Control Panel
Version: before 1.9.5
Vulnerability: Stored Cross-Site Scripting
Severity: Medium (CVSS 5.1)
date: 2026-07-10
Prediction: 2026-07-15
What Undercode Say:
Analytics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: Passive
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: None
- Sub-Confidentiality Impact: Low
- Sub-Integrity Impact: Low
- Exploit Maturity: Not Defined
Bash Commands & Codes:
Check HestiaCP version
hestiacp -v
Identify vulnerable installations
grep -r "hestiacp" /usr/local/hestia/version
Simulate payload creation (proof of concept)
curl -X POST https://target:8083/api/dns/add \
-H "Authorization: Bearer <token>" \
-d "domain=example.com&record=test&type=A&value=\"%22%3E%3Cscript%3Ealert('XSS')%3C/script%3E"
Exploit:
An authenticated low-privilege user can exploit this vulnerability by creating a DNS record with a malicious value. The payload must include a double-quote to break out of the `data-sort-value` attribute, followed by the script. For example:
– Payload: `” onmouseover=”alert(document.cookie)”`
– Alternatively: `”>`
Once the record is created, any user (including admins) who views the DNS list will trigger the script. The attacker can then steal session cookies, perform CSRF attacks, or escalate privileges.
Protection:
- Upgrade HestiaCP to version 1.9.5 or later, where proper `htmlspecialchars()` encoding is applied.
- Apply input validation on the DNS record value field to reject or sanitize dangerous characters.
- Restrict DNS record creation to trusted administrators only.
- Monitor logs for suspicious DNS record additions containing script tags or event handlers.
- Use a Web Application Firewall (WAF) to block XSS payloads in request parameters.
- Regular security audits of the codebase to identify similar output encoding issues.
Impact:
- Session Hijacking: Attackers can steal session cookies of administrators, gaining unauthorized access.
- Privilege Escalation: Low-privilege users can execute actions with admin privileges via XSS.
- Data Theft: Sensitive information displayed in the panel can be exfiltrated.
- UI Redress: The interface can be defaced or modified to trick users.
- Persistence: The malicious DNS record remains until manually removed, affecting all users.
- Reputation Damage: Organizations using HestiaCP may suffer loss of trust.
- Compliance Violations: GDPR, HIPAA, or PCI DSS breaches due to data exposure.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
