GHSA-25gq-jvx2-vg9x Silverstripe X-Forwarded-Host request hostname injection
Attackers can inject hostnames via X-Forwarded-Host to redirect users, affecting Silverstripe sites not behind reverse proxies.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-25gq-jvx2-vg9x?
GHSA-25gq-jvx2-vg9x is a vulnerability in silverstripe/framework, published on 23 May 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A potential hostname injection vulnerability has been found which could allow attackers to alter url resolution.
If a request contains the X-Forwarded-Host HTTP header a website would then use its value in place of the actual HTTP hostname. In cases where caching is enabled, this could allow an attacker to potentially embed a remote url as the base_url for any site. This would then cause other visitors to the site to be redirected unknowingly.
This header is necessary for servers running behind a reverse proxy (such as nginx). Such servers are likely not vulnerable to this risk.
A fix has been merged into the default installer, although existing projects which do not run behind a reverse proxy should update their htaccess as below:
<IfModule mod_headers.c>
# Remove X-Forwarded-Host header sent as a part of any request from the web
RequestHeader unset X-Forwarded-Host
</IfModule>
Which versions are affected by GHSA-25gq-jvx2-vg9x?
2 open source packages ship an affected version, including silverstripe/framework.
| Package | Affected | Fixed in |
|---|---|---|
silverstripe/framework Packagist | From 3.1.0 | 3.1.13 |
silverstripe/framework Packagist | From 3.1.0 | 3.1.13 |
How do I fix GHSA-25gq-jvx2-vg9x?
Upgrade silverstripe/framework to 3.1.13 or later.
Is GHSA-25gq-jvx2-vg9x being exploited?
There is no known exploitation of GHSA-25gq-jvx2-vg9x in the wild and no public exploit code.