An authenticated stored cross-site scripting vulnerability in VestaCP allows attackers to execute arbitrary scripts, posing a significant risk to administrative session integrity.

The application is susceptible to a stored cross-site scripting (XSS) attack via the v_interface parameter. An authenticated user with sufficient privileges to access the IP configuration can inject a malicious script into the application, which is then stored and executed in the context of other users, including administrators, when they view the affected interface.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser of a victim, which can lead to session hijacking, unauthorized actions performed on behalf of the user, or the theft of sensitive session cookies. Given the administrative nature of the VestaCP interface, this could result in a full compromise of the hosting control panel environment. The CVSS score of 7.2 reflects the high potential for impact on confidentiality and integrity despite requiring authenticated access.

Immediate Action: Update VestaCP to version 0.9.8-26 or later to incorporate the vendor-supplied security patches.

Proactive Monitoring: Review access logs for suspicious POST requests directed at the /add/ip/ endpoint, particularly those containing script tags or encoded characters.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect and block malicious payloads containing script tags within HTTP POST parameters to provide temporary protection.

Public Exploit Available: Yes, a proof-of-concept exists as documented in the Exploit-DB entry 49662.

This vulnerability presents a clear risk to administrative and user sessions within the VestaCP control panel. Administrators should treat this issue with high urgency, prioritizing the application of the vendor patch to ensure the security of the management interface. Organizations unable to patch immediately must implement strict access controls for administrative functions and utilize WAF filtering to mitigate the risk of script injection.