A critical IP spoofing vulnerability in HestiaCP permits unauthenticated attackers to manipulate trusted sources, potentially leading to unauthorized access.

This vulnerability (CWE-348) involves the trust of less-secure sources, specifically the improper handling of the CF-Connecting-IP header, allowing an unauthenticated attacker to spoof their source IP address.

By spoofing their IP address, an attacker can bypass IP-based access control lists (ACLs) and security filters, potentially gaining unauthorized administrative access to the control panel. With a CVSS score of 7.5, this vulnerability represents a significant risk to the security posture and integrity of the managed hosting environment.

Immediate Action: Update HestiaCP to the latest version, ensuring the fix from commit f381e294500f671cf12716c638afd0bfde901f88 is applied.

Proactive Monitoring: Review web server access logs for anomalous requests containing header-based IP modifications that do not match expected traffic sources.

Compensating Controls: Configure edge infrastructure or firewalls to strip or ignore the CF-Connecting-IP header unless specifically required for legitimate Cloudflare integration.

Public Exploit Available: No (exploit_available: false)

Given the availability of a proof-of-concept and the nature of the vulnerability, administrators should verify their current version and apply the vendor-provided patch immediately to mitigate the risk of unauthorized access.