Pimcore admin-ui-classic-bundle up to 1.3.3 HTTP Header invitationLinkAction Host injection

Summaryinfo

A vulnerability was found in Pimcore admin-ui-classic-bundle up to 1.3.3. It has been rated as problematic. The impacted element is the function invitationLinkAction of the component HTTP Header Handler. This manipulation of the argument Host causes injection. This vulnerability is tracked as CVE-2024-25625. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as problematic was found in Pimcore admin-ui-classic-bundle up to 1.3.3. Affected by this vulnerability is the function invitationLinkAction of the component HTTP Header Handler. The manipulation of the argument Host with an unknown input leads to a injection vulnerability. The CWE definition for the vulnerability is CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. A potential security vulnerability has been discovered in `pimcore/admin-ui-classic-bundle` prior to version 1.3.4. The vulnerability involves a Host Header Injection in the `invitationLinkAction` function of the UserController, specifically in the way `$loginUrl` trusts user input. The host header from incoming HTTP requests is used unsafely when generating URLs. An attacker can manipulate the HTTP host header in requests to the /admin/user/invitationlink endpoint, resulting in the generation of URLs with the attacker's domain. In fact, if a host header is injected in the POST request, the $loginURL parameter is constructed with this unvalidated host header. It is then used to send an invitation email to the provided user. This vulnerability can be used to perform phishing attacks by making the URLs in the invitation links emails point to an attacker-controlled domain. Version 1.3.4 contains a patch for the vulnerability. The maintainers recommend validating the host header and ensuring it matches the application's domain. It would also be beneficial to use a default trusted host or hostname if the incoming host header is not recognized or is absent.

The weakness was disclosed 02/19/2024. It is possible to read the advisory at github.com. This vulnerability is known as CVE-2024-25625 since 02/08/2024. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1055 according to MITRE ATT&CK.

Upgrading to version 1.3.4 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Information Management Software

Vendor

• Pimcore

Name

• admin-ui-classic-bundle

Version

• 1.3.0
• 1.3.1
• 1.3.2
• 1.3.3

License

• open-source

Website

• Product: https://github.com/pimcore/admin-ui-classic-bundle/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion