CVE-2021-47871
Arbitrary File Write in Hestia Control Panel 1.3.2 via API
Publication date: 2026-01-21
Last updated on: 2026-01-21
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| hestiacp | hestia_control_panel | to 1.3.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-73 | The product allows user input to control or influence paths or file names that are used in filesystem operations. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2021-47871 is an arbitrary file write vulnerability in Hestia Control Panel version 1.3.2 and earlier. Authenticated attackers can exploit the API endpoint index.php by using the "v-make-tmp-file" command to write files to arbitrary locations on the server. For example, an attacker can write SSH public keys into files like /home/admin/.ssh/authorized_keys, potentially enabling unauthorized SSH access. This vulnerability allows attackers to place malicious files anywhere on the server, which can lead to further compromise. [1, 3]
How can this vulnerability impact me? :
This vulnerability can allow an authenticated attacker to write arbitrary files anywhere on the server, including malicious SSH keys. This can lead to unauthorized remote access, remote code execution, and full compromise of the server. The attacker could maintain persistent access or disrupt server operations, severely impacting confidentiality, integrity, and availability of the system. [1, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for suspicious POST requests to the API endpoint at port 8083, specifically to https://TARGET:8083/api/index.php. Look for requests containing the 'v-make-tmp-file' command with parameters that attempt to write files, such as SSH keys, to arbitrary locations. A sample detection command using curl to test the vulnerability could be crafted to send a POST request with parameters 'hash', 'returncode', 'cmd', and arguments specifying file content and destination path. For example, sending a POST request with 'cmd=v-make-tmp-file' and arguments targeting the '/home/admin/.ssh/authorized_keys' file. Network intrusion detection systems can be configured to alert on such patterns. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade Hestia Control Panel to version 1.3.3 or later, where this arbitrary file write vulnerability has been fixed. Additionally, restrict access to the API endpoint to trusted users only, enforce strong authentication, and monitor logs for suspicious activity involving the 'v-make-tmp-file' command. If upgrading immediately is not possible, consider disabling or restricting the vulnerable API functionality until a patch can be applied. [1, 3]