CVE-2021-21265: Potential Host Header Poisoning on misconfigured servers in october/backend
Summary
CVE-2021-21265: October CMS vulnerable to Potential Host Header Poisoning on misconfigured servers. Affects october/backend versions < 1.1.2. Fixed in 1.1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The october/backend package is a part of the October CMS, an open-source content management system built on the Laravel framework. It provides the backend functionality for managing and organizing website content. The package allows administrators to create, edit, and delete pages, manage user permissions, and handle other administrative tasks. However, misconfigured servers running October CMS may be vulnerable to a potential Host Header Poisoning attack.
Vulnerability Detail
The vulnerability arises when servers are configured to accept a wildcard as a hostname, causing all requests, regardless of the HOST header, to be routed to an October CMS instance. This opens up the possibility of Host Header Poisoning attacks. Host Header Poisoning occurs when an attacker manipulates the HOST header to bypass security measures or perform malicious actions. The impact of such an attack can range from unauthorized access to sensitive information to complete server compromise. The vulnerability has a low severity rating (CWE-644) but should still be addressed to prevent potential exploitation.
How To Fix
Minimum fixed version
1.1.2
This is the first release that contains the fix.
composer require october/backend:1.1.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading or applying the patches is not possible, a temporary workaround is to ensure that the web server does not accept any hostname when serving the web application. This can be achieved by configuring the web server to only allow known hostnames. One way to test this is by adding an entry called testing.tld to the computer's host file and directing it to the server's IP address. Opening the address testing.tld in a web browser should not return an October CMS website. If an October CMS website is still accessible, further configuration of the web server is required. It is recommended to seek assistance from a server administrator if needed.
Conclusion
The potential Host Header Poisoning vulnerability in the october/backend package can pose a risk to misconfigured servers running October CMS. It is crucial to address this vulnerability by upgrading to version 1.1.2 or applying the provided patches. If neither option is possible, implementing the suggested workaround of configuring the web server to only allow known hostnames can help mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for october/backend →
FAQ
Host Header Poisoning is a type of attack where an attacker manipulates the HOST header of an HTTP request to bypass security measures or perform malicious actions. By modifying the HOST header, an attacker can trick the server into processing the request in unexpected ways.
The consequences of Host Header Poisoning can vary depending on the specific vulnerability being exploited. In some cases, it can lead to unauthorized access to sensitive information, session hijacking, or even complete server compromise.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the composer.lock file.
Yes, upgrading to version 1.1.2 of the october/backend package is the recommended fix for this vulnerability. Alternatively, you can manually apply the provided patches to your installation. If neither option is feasible, implementing the suggested workaround of configuring the web server to only allow known hostnames can help mitigate the risk.
This vulnerability was reported by Abdullah Hussam and disclosed through the GitHub Security Advisory (GHSA) program.
References
Related vulnerabilities
Recent vulnerabilities recorded for october/backend.
