Potential Security Vulnerability in Pimcore's Admin Classic Bundle

CVE-2024-25625

Summary

A vulnerability in Pimcore's Admin Classic Bundle has been identified, specifically within the invitationLinkAction function of the UserController. This issue arises from improper handling of the HTTP host header, allowing an attacker to inject a malicious host header into requests directed at the /admin/user/invitationlink endpoint. As a result, URLs generated for user invitations may point to an attacker-controlled domain. The $loginUrl parameter in email invitations is constructed without proper validation of the host header, making this vulnerability a potential vector for phishing attacks. The recommended mitigation includes validating the host header to ensure it corresponds with the application's domain and employing a default trusted host mechanism when the incoming header is unrecognized or absent. Version 1.3.4 addresses this vulnerability with necessary patches.

References