Pimcore Admin Classic Bundle host header injection in the password reset

CVE-2024-23648

Summary

The Admin Classic Bundle of Pimcore features a backend user interface that includes a password reset functionality. This system emails users a URL containing a unique token, which is valid for 24 hours, allowing them to reset their passwords. Prior to version 1.2.3, the vulnerability stemmed from how the reset-password URL was generated, leveraging the 'Host' HTTP header from the initial password reset request. Attackers could exploit this by sending fraudulent password reset requests, manipulating the 'Host' header to a controlled domain. If a user clicked the malicious link, the attacker could obtain the sensitive reset token, leading to potential account takeover. Users are advised to upgrade to version 1.2.3 or later to mitigate this risk.

References