GHSA-25gq-jvx2-vg9x: Silverstripe X-Forwarded-Host request hostname injection
A potential hostname injection vulnerability has been found which could allow attackers to alter url resolution.
If a request contains the X-Forwarded-Host HTTP header a website would then use its value in place of the actual HTTP hostname. In cases where caching is enabled, this could allow an attacker to potentially embed a remote url as the base_url for any site. This would then cause other visitors to the site to be redirected unknowingly.
This header is necessary for servers running behind a reverse proxy (such as nginx). Such servers are likely not vulnerable to this risk.
A fix has been merged into the default installer, although existing projects which do not run behind a reverse proxy should update their htaccess as below:
<IfModule mod_headers.c>
References
- github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2015-013-1.yaml
- github.com/advisories/GHSA-25gq-jvx2-vg9x
- github.com/silverstripe/silverstripe-framework
- github.com/silverstripe/silverstripe-framework/commit/75137dbab28c0efd28b07e50044a50c5af4e46aa
- www.silverstripe.org/software/download/security-releases/ss-2015-013
Code Behaviors & Features
Detect and mitigate GHSA-25gq-jvx2-vg9x with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →