PT-2017-17909 · Concrete5 · Concrete5
Hyp3Rlinx
+1
·
Published
2017-04-13
·
Updated
2022-05-13
·
CVE-2017-7725
CVSS v3.1
6.1
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
concrete5 version 8.1.0
Description
The issue arises from incorrect trust in the HTTP Host header during caching, specifically when the administrator did not define a "canonical" URL on installation of concrete5 using the "Advanced Options" settings. Remote attackers can exploit this by making a GET request with any domain name in the Host header, which is then stored. This allows for arbitrary domains to be set for certain links displayed to subsequent visitors, potentially leading to an XSS vector.
Recommendations
For concrete5 version 8.1.0, consider defining a "canonical" URL on installation using the "Advanced Options" settings to prevent incorrect trust in the HTTP Host header. As a temporary workaround, restrict access to caching functionality until a proper fix is applied. Additionally, monitor and limit the domains that can be set for links displayed to visitors to minimize the risk of exploitation.
Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Concrete5