p PatchFirst

GHSA-25gq-jvx2-vg9x

GHSA-25gq-jvx2-vg9x · Silverstripe X-Forwarded-Host request hostname injection

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A potential hostname injection vulnerability has been found which could allow attackers to alter url resolution. If a request contains the X-Forwarded-Host HTTP header a website would then use its value in place of the actual HTTP hostname. In cases where caching is enabled, this could allow an attacker to potentially embed a remote url as the base_url for any site. This would then cause other visitors to the site to be redirected unknowingly. This header is necessary for servers running behind a reverse proxy (such as nginx). Such servers are likely not vulnerable to this risk. A fix has been merged into the default installer, although existing projects which do not run behind a reverse proxy should update their htaccess as below: ``` <IfModule mod_headers.c> # Remove X-Forwarded-Host header sent as a part of any request from the web RequestHeader unset X-Forwarded-Host </IfModule> ```

CVSS 7.2 · High · Fix available

Published
Updated

Stack: php

Affected products and versions

  • silverstripe/framework Packagist

    Versions
    • 3.1.0
    • 3.1.1
    • 3.1.10
    • 3.1.10-rc1
    • 3.1.10-rc2
    • 3.1.11
    • 3.1.11-rc1
    • 3.1.12
    • 3.1.13-rc1
    • 3.1.2
    • 3.1.2-rc1
    • 3.1.3
    • 3.1.3-rc1
    • 3.1.3-rc2
    • 3.1.4
    • 3.1.4-rc1
    • 3.1.5
    • 3.1.5-rc1
    • 3.1.6
    • 3.1.6-rc1
    • 3.1.6-rc2
    • 3.1.6-rc3
    • 3.1.7
    • 3.1.7-rc1
    • 3.1.8
    • 3.1.9
    • 3.1.9-rc1
    Affected ranges
    • ECOSYSTEM: ≥ 3.1.0, < 3.1.13

    Update to 3.1.13

Original sources

Check your server →