CVE-2024-55925 API Security bypass through header manipulation
Attackers can bypass API host restrictions in Xerox Workplace Suite by manipulating the Host header to access unauthorized endpoints.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-55925?
CVE-2024-55925 is a high-severity authentication bypass vulnerability in Xerox Workplace Suite, published on 23 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Xerox Workplace Suite, an API restricted to specific hosts can be bypassed by manipulating the Host header. If the server improperly validates or trusts the Host header without verifying the actual destination, an attacker can forge a value to gain unauthorized access. This exploit targets improper host validation, potentially exposing sensitive API endpoints.
Weakness: CWE-290
Which versions are affected by CVE-2024-55925?
It affects 1 product.
Products include Xerox Workplace Suite.
How do I fix CVE-2024-55925?
No fix has been published for CVE-2024-55925 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-55925 being exploited?
There is no known exploitation of CVE-2024-55925 in the wild and no public exploit code.
Other vulnerabilities in Xerox Workplace Suite
- CVE-2024-55926 Arbitrary file upload, deletion and read through header manipulation
- CVE-2024-55927 Flawed token generation implementation & Hard-coded key implementation
- CVE-2024-55930 Weak default folder permissions
- CVE-2024-55931 Token stored in session storage
- CVE-2024-55928 Clear text secrets returned & Remote system secrets in clear text
Sources
Also known as GHSA-54pf-9qmv-m7pj.