CVE-2021-47873

Deeper analysis

CVE-2021-47873 is a stored cross-site scripting (XSS) vulnerability affecting VestaCP versions prior to 0.9.8-25. The flaw resides in the IP interface configuration functionality, where the 'v_interface' parameter in the /add/ip/ endpoint fails to properly sanitize user input. This allows attackers to inject malicious scripts via a crafted POST request, resulting in CWE-79. The vulnerability carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), indicating high severity due to its network accessibility, lack of prerequisites, and changed scope.

Unauthenticated attackers (PR:N) can exploit this vulnerability remotely by sending a specially crafted POST request to the /add/ip/ endpoint with a stored XSS payload in the 'v_interface' parameter. Once injected, the malicious script persists and executes in the context of any authenticated user's browser that views the affected IP interface configuration page, such as an administrator. Successful exploitation enables limited confidentiality and integrity impacts, such as session hijacking, data theft, or further phishing within the application's scope.

Advisories and references, including those from VestaCP (vestacp.com, myvestacp.com), VulnCheck, and an Exploit-DB entry (exploit 49662), detail the issue and imply mitigation through upgrading to VestaCP version 0.9.8-25 or later, which addresses the input validation flaw. Security practitioners should review these sources for full patch details and verify configurations.