CVE-2022-25355: EC-CUBE Improper Handling of HTTP Host Header Values
Summary
CVE-2022-25355: EC-CUBE improperly handles HTTP Host header values. Affects ec-cube/ec-cube across 2 version ranges.
>= 3.0.0, <= 3.0.18-p3
>= 4.0.0, < 4.1.2
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
EC-CUBE is an open-source e-commerce platform written in PHP. It provides various features for creating and managing online stores. The vulnerability affects EC-CUBE versions 3.0.0 to 3.0.18-p3 and 4.0.0 to 4.1.1. EC-CUBE improperly handles HTTP Host header values, which can be exploited by a remote unauthenticated attacker. This vulnerability allows the attacker to direct the vulnerable version of EC-CUBE to send an email with a forged reissue-password URL to EC-CUBE users.
Vulnerability Detail
The vulnerability in EC-CUBE arises from the improper handling of HTTP Host header values. When an attacker sends a specially crafted HTTP request with a manipulated Host header, EC-CUBE may process the request incorrectly. This can lead to the generation of forged reissue-password URLs in emails sent to EC-CUBE users. If users click on these URLs, they may be directed to malicious websites or inadvertently disclose sensitive information. The vulnerability has a CVSS score of 5.3, indicating a moderate severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by updating to the latest version of EC-CUBE.
Conclusion
EC-CUBE versions 3.0.0 to 3.0.18-p3 and 4.0.0 to 4.1.1 are vulnerable to an improper handling of HTTP Host header values. This can be exploited by a remote unauthenticated attacker to send forged reissue-password URLs to EC-CUBE users. To mitigate this vulnerability, users should update to the latest version of EC-CUBE. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ec-cube/ec-cube →
FAQ
EC-CUBE is an open-source e-commerce platform written in PHP. It provides features for creating and managing online stores.
EC-CUBE versions 3.0.0 to 3.0.18-p3 and 4.0.0 to 4.1.1 are affected by this vulnerability.
An attacker can exploit this vulnerability by sending a specially crafted HTTP request with a manipulated Host header. This can lead to the generation of forged reissue-password URLs in emails sent to EC-CUBE users.
The potential consequences of this vulnerability include users being directed to malicious websites or inadvertently disclosing sensitive information when clicking on forged reissue-password URLs.
This vulnerability has a CVSS score of 5.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for ec-cube/ec-cube.
