CVE-2021-47871: Hestia Control Panel File Write Vulnerability

CVE-2021-47871 Overview

CVE-2021-47871 is an arbitrary file write vulnerability affecting Hestia Control Panel version 1.3.2. This flaw allows authenticated attackers to write files to arbitrary locations on the server by exploiting the API index.php endpoint. By leveraging the v-make-tmp-file command, attackers can write SSH keys or other malicious content to specific file paths, potentially leading to complete server compromise.

Critical Impact

Authenticated attackers can write arbitrary files to the server, enabling SSH key injection, configuration tampering, and potential remote code execution through web shells or cron jobs.

Affected Products

• Hestia Control Panel 1.3.2
• Hestia Control Panel versions prior to the patched release
• Linux servers running vulnerable HestiaCP installations

Discovery Timeline

• 2026-01-21 - CVE CVE-2021-47871 published to NVD
• 2026-01-21 - Last updated in NVD database

Technical Details for CVE-2021-47871

Vulnerability Analysis

This vulnerability is classified under CWE-73 (External Control of File Name or Path), which occurs when software allows external input to influence file system operations without proper validation. In the context of Hestia Control Panel, the v-make-tmp-file command exposed through the API endpoint fails to properly sanitize the target file path parameter, allowing authenticated users to specify arbitrary locations on the file system.

The attack requires authentication to the HestiaCP panel, meaning an attacker must possess valid credentials. However, once authenticated, even low-privilege users may be able to exploit this vulnerability to escalate their access by writing SSH authorized_keys files or modifying system configurations.

Root Cause

The root cause of CVE-2021-47871 lies in insufficient input validation within the v-make-tmp-file command handler. The API endpoint at index.php accepts user-controlled parameters for file path specification without adequately checking for path traversal sequences or restricting writes to safe directories. This allows an attacker to escape the intended temporary file directory and write content to sensitive system locations.

Attack Vector

The attack is network-based and requires authentication to the Hestia Control Panel web interface. An attacker with valid credentials can craft a malicious API request to the index.php endpoint, specifying a target path outside the expected temporary directory. Common exploitation scenarios include:

The attacker sends a crafted POST request to the API endpoint with the v-make-tmp-file command, specifying a target path such as /root/.ssh/authorized_keys along with attacker-controlled SSH public key content. Upon successful execution, the attacker gains SSH access to the server with root privileges.

Additionally, attackers may write web shells to accessible web directories, create malicious cron jobs, or overwrite configuration files to further compromise the system. Technical details and proof-of-concept code can be found in the Exploit-DB #49667 entry.

Detection Methods for CVE-2021-47871

Indicators of Compromise

• Unexpected modifications to /root/.ssh/authorized_keys or other user SSH key files
• Suspicious API requests to index.php containing v-make-tmp-file with unusual file paths
• New web shell files appearing in web-accessible directories
• Unexplained modifications to system configuration files or cron jobs

Detection Strategies

• Monitor HestiaCP API logs for requests containing the v-make-tmp-file command with path traversal patterns such as ../ sequences
• Implement file integrity monitoring (FIM) on critical system files including SSH authorized_keys, cron directories, and web roots
• Deploy web application firewall rules to detect and block API requests containing suspicious file path parameters
• Review authentication logs for unusual access patterns that may indicate compromised credentials being used for exploitation

Monitoring Recommendations

• Enable detailed logging for all HestiaCP API endpoint interactions
• Configure real-time alerts for modifications to SSH configuration files and authorized_keys across all user accounts
• Monitor for new file creation events in web-accessible directories that could indicate web shell deployment
• Implement anomaly detection for file write operations originating from the HestiaCP application user context

How to Mitigate CVE-2021-47871

Immediate Actions Required

• Upgrade Hestia Control Panel to the latest available version that addresses this vulnerability
• Audit existing user accounts and revoke access for any unnecessary or suspicious accounts
• Review SSH authorized_keys files across all system users for unauthorized entries
• Temporarily restrict network access to the HestiaCP administrative interface to trusted IP addresses only
• Implement additional authentication controls such as multi-factor authentication for panel access

Patch Information

Users should upgrade Hestia Control Panel to a version newer than 1.3.2 that includes fixes for this arbitrary file write vulnerability. The latest releases can be obtained from the GitHub HestiaCP Repository or the HestiaCP Official Website. Additional vulnerability details are available in the VulnCheck HestiaCP Advisory.

Workarounds

• Implement strict IP-based access controls to limit HestiaCP panel access to trusted administrative networks only
• Deploy a web application firewall (WAF) with rules to filter API requests containing path traversal patterns or targeting the v-make-tmp-file endpoint
• Temporarily disable or restrict access to the vulnerable API endpoint if the upgrade cannot be performed immediately
• Run HestiaCP under a restricted user account with limited file system write permissions to reduce the impact of exploitation

# Configuration example - Restrict HestiaCP panel access by IP using iptables
# Allow access only from trusted administrative IP
iptables -A INPUT -p tcp --dport 8083 -s 192.168.1.100 -j ACCEPT
iptables -A INPUT -p tcp --dport 8083 -j DROP

# Alternative: Use nginx/apache access control
# In nginx configuration for HestiaCP:
# location / {
#     allow 192.168.1.100;
#     deny all;
# }