PT-2023-6601 · Plesk · Plesk Obsidian

Tjetnipat · Published 2023-01-21 · Updated 2025-04-02 · CVE-2023-24044

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Plesk Obsidian versions through 18.0.49

Description A Host Header Injection issue on the Login page allows attackers to redirect users to malicious websites via a Host request header. The issue is related to the ability to use arbitrary domain names to access the panel, which the vendor considers an intended feature. This can be exploited by sending a specially crafted Host HTTP request header, potentially allowing a remote attacker to redirect users to arbitrary websites.

Recommendations For Plesk Obsidian versions through 18.0.49, consider restricting access to the Login page or disabling the ability to use arbitrary domain names to access the panel as a temporary workaround until a fix is available. Avoid using the Host request header in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

BDU:2023-07368

CVE-2023-24044

Affected Products

Plesk Obsidian

References · 11

• 🔥 https://medium.com/@jetnipat.tho/cve-2023-24044-10e48ab940d8 · Exploit
• 🔥 https://gist.github.com/TJetnipat/02b3854543b7ec95d54a8de811f2e8ae · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-24044 · Security Note
• https://osv.dev/vulnerability/CVE-2023-24044 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07368 · Security Note
• https://support.plesk.com/hc/en-us/articles/10254625170322-Vulnerability-CVE-2023-24044 · Note
• https://medium.com/%40jetnipat.tho/cve-2023-24044-10e48ab940d8 · Note
• https://t.me/cvenotify/45163 · Telegram Post
• https://t.me/cvenotify/117377 · Telegram Post
• https://t.me/cvenotify/42627 · Telegram Post
• https://t.me/cvenotify/88505 · Telegram Post