PT-2021-14373 · Octobercms · October

Abdullah Hussam · Published 2021-03-10 · Updated 2025-05-30 · CVE-2021-21265

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: October versions prior to 1.1.2

Description: The issue exists in October when running on poorly configured servers, where the server routes any request, regardless of the HOST header, to an October CMS instance. This allows for Host Header Poisoning attacks to succeed. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited. To mitigate the risk, it is recommended to configure the web server to only allow known hostnames.

Recommendations: For versions prior to 1.1.2, update to version 1.1.2, which adds a feature to allow a set of trusted hosts to be specified in the application. As a temporary workaround, set the configuration setting cms.linkPolicy to force. Apply the manual patches from https://github.com/octobercms/library/commit/f86fcbcd066d6f8b939e8fe897409d152b11c3c6 and https://github.com/octobercms/october/commit/f638d3f78cfe91d7f6658820f9d5e424306a3db0 to your installation if unable to upgrade to v1.1.2. Check that your web server does not accept any hostname when serving your web application by adding an entry called testing.tld to your computer's host file, directing it to your server's IP address, and ensuring an October CMS website is not available at this address. If an October CMS website is returned, configure your web server to only allow known hostnames.

Fix

Weakness Enumeration

CWE-644

Related Identifiers

CVE-2021-21265

GHSA-XHFX-HGMF-V6VP

Affected Products

October

References · 12

• https://github.com/octobercms/october/commit/f638d3f78cfe91d7f6658820f9d5e424306a3db0 · Patch
• https://github.com/octobercms/october/security/advisories/GHSA-xhfx-hgmf-v6vp · Patch
• https://github.com/octobercms/library/commit/f86fcbcd066d6f8b939e8fe897409d152b11c3c6 · Patch
• https://osv.dev/vulnerability/GHSA-xhfx-hgmf-v6vp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21265 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21265 · Security Note
• https://github.com/octobercms/october/commit/555ab61f2313f45d7d5d138656420ead536c5d30 · Note
• https://github.com/octobercms/library/commit/f29865ae3db7a03be7c49294cd93980ec457f10d · Note
• https://t.me/cvenotify/11540 · Telegram Post
• https://packagist.org/packages/october/backend · Note
• https://t.me/cibsecurity/24743 · Telegram Post
• https://t.me/cvenotify/124074 · Telegram Post