CVE-2024-23648: Host Header Injection in Pimcore Admin-UI-Classic-Bundle Password Reset
Summary
CVE-2024-23648: Host header injection in the password reset. Affects pimcore/admin-ui-classic-bundle versions < 1.2.3. Fixed in 1.2.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pimcore Admin-UI-Classic-Bundle is a package used in the Pimcore platform for managing the administration interface. It provides various functionalities for user management, including password reset. However, a vulnerability has been discovered in the password reset functionality that allows for host header injection. This vulnerability can be exploited by an attacker to manipulate the reset URL and perform account takeover.
Vulnerability Detail
The password reset functionality in Pimcore Admin-UI-Classic-Bundle generates a unique token-based URL for resetting a user's password. This URL is constructed using the 'Host' HTTP header of the request sent to request a password reset. An attacker can send password reset requests for users, specifying a controlled 'Host' header. If a user clicks on the link in the email, the attacker can retrieve the reset token and gain unauthorized access to the victim's account. This vulnerability is present when the server is configured to serve Pimcore on arbitrary 'Host' headers, which may occur if the server is behind a reverse proxy. The impact of this vulnerability is a potential 1-click account takeover.
How To Fix
Minimum fixed version
1.2.3
This is the first release that contains the fix.
composer require pimcore/admin-ui-classic-bundle:1.2.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in Pimcore Admin-UI-Classic-Bundle's password reset functionality allows for host header injection, potentially leading to a 1-click account takeover. To mitigate this vulnerability, it is important to properly set the server host variable and ensure that the server does not serve Pimcore on any arbitrary 'Host' header. Version 1.2.3 of the package includes a fix for this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pimcore/admin-ui-classic-bundle →
FAQ
The impact of this vulnerability is a potential 1-click account takeover. An attacker can manipulate the password reset URL and gain unauthorized access to a victim's account.
To fix this vulnerability, a variable should be created to set the server host. The password reset functionality should only be enabled when this variable is properly set. Alternatively, administrators should ensure that the server does not serve Pimcore on any arbitrary 'Host' header.
A recommended approach is to create a configuration variable, similar to 'APP_ALLOW_INSECURE_HOSTS' used in the Snipe-IT project, and retrieve the app's absolute URL from a configuration file.
Yes, a fix is available in version 1.2.3 of the Pimcore Admin-UI-Classic-Bundle package.
Yes, this vulnerability can be exploited remotely by an attacker sending password reset requests with a manipulated 'Host' header.
References
Related vulnerabilities
Recent vulnerabilities recorded for pimcore/admin-ui-classic-bundle.
