Silverstripe Framework: X-Forwarded-Host Request Hostname Injection
Summary
GHSA-25gq-jvx2-vg9x: Silverstripe X-Forwarded-Host request hostname injection. Affects silverstripe/framework versions >= 3.1.0, < 3.1.13. Fixed in 3.1.13. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Silverstripe Framework is a popular open-source PHP web application framework used for building websites and web applications. It provides a range of features and functionalities to developers, including content management, templating, and database management. However, a vulnerability has been discovered in the framework that allows for potential hostname injection through the X-Forwarded-Host HTTP header.
Vulnerability Detail
The vulnerability arises when a request contains the X-Forwarded-Host header, which is used by websites to determine the HTTP hostname. In cases where caching is enabled, an attacker can manipulate the X-Forwarded-Host header to embed a remote URL as the base_url for the site. This can lead to unknowing redirection of other visitors to the site. It's important to note that servers running behind a reverse proxy are likely not vulnerable to this risk.
How To Fix
Minimum fixed version
3.1.13
This is the first release that contains the fix.
composer require silverstripe/framework:3.1.13Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The Silverstripe Framework is susceptible to a hostname injection vulnerability through the X-Forwarded-Host header. This can lead to the embedding of a remote URL as the base_url for the site, resulting in unknowing redirection of visitors. It is crucial for affected projects to apply the necessary fix by updating their htaccess file. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for silverstripe/framework →
FAQ
The vulnerability allows an attacker to manipulate the X-Forwarded-Host header, potentially leading to the embedding of a remote URL as the base_url for the site. This can result in unknowing redirection of site visitors.
The vulnerability affects websites and web applications built using the Silverstripe Framework versions 3.1.0 to 3.1.13, which do not run behind a reverse proxy.
Yes, a fix has been implemented in the default installer. Existing projects should update their htaccess file as mentioned in the 'how_to_fix' section.
Servers running behind a reverse proxy are likely not vulnerable to this risk, as the X-Forwarded-Host header is necessary for their proper functioning.
You can find more information about this vulnerability, including its technical details and impact, in the advisory published on the GitHub Advisory Database. The link to the advisory is provided in the 'affected' section of this report.
References
Related vulnerabilities
Recent vulnerabilities recorded for silverstripe/framework.
