Sutol

**Name of the Vulnerable Software and Affected Versions** HestiaCP versions 1.9.0 through 1.9.4 **Description** A deserialization issue exists in the web terminal component due to a session format mismatch between PHP and Node.js. This allows unauthenticated remote attackers to achieve root-level code execution by injecting crafted data into HTTP headers. These headers are processed by the PHP session handler and incorrectly deserialized by the Node.js web terminal component as trusted session values, leading to arbitrary command execution on systems where the web terminal feature is enabled. **Recommendations** Update HestiaCP versions 1.9.0 through 1.9.4 to a patched version. As a temporary workaround, disable the web terminal feature to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** HestiaCP versions 1.2.0 through 1.9.4 **Description** An IP spoofing issue allows unauthenticated remote attackers to bypass authentication security controls. This occurs when the system accepts an arbitrary IP address provided in the 'CF-Connecting-IP' HTTP header without verifying that the request actually originated from the Cloudflare network. Exploitation enables attackers to circumvent fail2ban brute-force protection, bypass per-user IP allowlists, and poison authentication audit logs by spoofing trusted IP addresses. **Recommendations** Update HestiaCP to a version later than 1.9.4. As a temporary mitigation, restrict access to the control panel or configure the server to only accept 'CF-Connecting-IP' headers from verified Cloudflare IP ranges.

**Name of the Vulnerable Software and Affected Versions** Pannellum versions 2.5.6 through 3.5.0 **Description** Pannellum, a lightweight panorama viewer for the web, has an issue where the hot spot attributes configuration property allows setting any attribute, including HTML event handler attributes. This can lead to potential cross-site scripting (XSS) attacks. This impacts websites hosting the standalone viewer HTML file and any use of untrusted JSON config files, bypassing the `escapeHTML` parameter's protections. Certain events trigger without user interaction, meaning visiting a URL pointing to a malicious config file can execute arbitrary JavaScript code, potentially replacing page content. Reports indicate this issue is actively exploited for cryptocurrency-related phishing attempts. The `attributes` property is the source of the issue. **Recommendations** Pannellum versions 2.5.6 through 3.5.0 should be updated to version 2.5.7 or later. As a workaround, set the Content-Security-Policy header to `script-src-attr 'none'` to block execution of inline event handlers. Do not host `pannellum.htm` on a domain that shares cookies with user authentication to reduce the risk of XSS.