CVE-2024-25625

Executive Summary

CVE-2024-25625 is a Host Header Injection vulnerability in Pimcore's Admin Classic Bundle (versions prior to 1.3.4). The flaw resides in the invitationLinkAction function of the UserController, where the HTTP Host header is unsafely used to construct invitation URLs. An attacker can manipulate this header to generate phishing links that point to an attacker-controlled domain, which are then sent via email to legitimate users. This can lead to credential theft or further compromise of the Pimcore instance. The CVSS score is 8.1 (High), and while no public exploit code exists, the attack vector is straightforward and requires no authentication.

Supply Chain & Package Security

This vulnerability affects the pimcore/admin-ui-classic-bundle package, which is a core component of the Pimcore ecosystem. Organizations using Pimcore should verify their dependency version and update to 1.3.4 or later. The package is distributed via Composer (PHP), and the fix is available in the official repository.

CVSS Breakdown & Threat Level

• CVSS Score: 8.1 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim clicks link)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The vulnerability is rated High due to the low complexity and the potential for phishing attacks that can lead to credential theft. The scope is changed because the attacker can redirect the victim to an external domain.

Deep Dive & Mechanics

The vulnerability exists in the invitationLinkAction method of UserController.php. When an admin sends an invitation to a new user, the application constructs a login URL using the Host header from the incoming HTTP request. This URL is then embedded in an email sent to the invitee.

Vulnerable Code Path:

1. The admin sends a POST request to /admin/user/invitationlink with a host header set by the attacker.
2. The application reads $_SERVER['HTTP_HOST'] without validation.
3. The $loginUrl is built using this unvalidated host: $loginUrl = 'https://' . $host . '/admin/login?token=...'.
4. The email is sent with the malicious URL.

An attacker can intercept or craft a request to this endpoint, setting the Host header to their own domain (e.g., evil.com). The resulting email will contain a link like https://evil.com/admin/login?token=.... If the victim clicks the link, they are taken to the attacker's site, which can mimic the Pimcore login page to steal credentials.

Vulnerable vs. Patched Code

Vulnerable Code (pre-1.3.4):

public function invitationLinkAction(Request $request): Response
{
    $host = $request->getHost(); // Unsafe: uses HTTP_HOST directly
    $loginUrl = 'https://' . $host . '/admin/login?token=' . $token;
    // ... send email with $loginUrl
}

Patched Code (1.3.4+):

public function invitationLinkAction(Request $request): Response
{
    $trustedHosts = $this->getParameter('pimcore.admin.trusted_hosts');
    $host = $request->getHost();
    if (!in_array($host, $trustedHosts, true)) {
        $host = $this->getParameter('pimcore.admin.default_host');
    }
    $loginUrl = 'https://' . $host . '/admin/login?token=' . $token;
    // ... send email with $loginUrl
}

The patch introduces a whitelist of trusted hosts and a fallback default host. If the incoming host header does not match any trusted host, the default host is used.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Access to the Pimcore admin panel (any authenticated user with invitation privileges).
• Ability to intercept or modify HTTP requests (e.g., Burp Suite, cURL).

Exploitation Steps:

1. Log in to Pimcore as an admin.
2. Intercept the POST request to /admin/user/invitationlink.
3. Modify the Host header to your attacker-controlled domain (e.g., evil.com).
4. Forward the request.
5. The victim receives an email with a link to https://evil.com/admin/login?token=....
6. Set up a phishing page on evil.com that mimics the Pimcore login form.
7. When the victim clicks the link and enters credentials, capture them.

Example cURL Command:

curl -X POST https://target-pimcore.com/admin/user/invitationlink \
  -H "Host: evil.com" \
  -H "Cookie: PHPSESSID=your_session" \
  -d "username=newuser@example.com"

Blue Team (Defender)

Detection Steps:

1. Monitor logs for unusual Host headers in POST requests to /admin/user/invitationlink.
2. Check email logs for invitation emails containing external domains.
3. Review web server logs for requests with mismatched Host headers.

Honeypot Setup:

• Deploy a fake invitation endpoint that logs all Host headers.
• Alert if the Host header does not match the expected domain.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /admin/user/invitationlink with a Host header not matching the legitimate domain.
  • Outbound emails containing URLs with external domains in the invitation link.
• Host IOCs:
  • Web server logs showing Host header manipulation.
  • Email logs with suspicious From or Reply-To addresses.
• File IOCs:
  • Modified UserController.php files (if backdoor present).
  • Unusual entries in parameters.yml or config.yml related to trusted hosts.

Detection Engineering

YARA Rule

rule CVE_2024_25625_HostHeaderInjection {
    meta:
        description = "Detects vulnerable Pimcore Admin Classic Bundle code"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-25625"
    strings:
        $vuln_code = "\\$loginUrl = 'https://' . \\$host . '/admin/login?token=' . \\$token;"
        $safe_code = "if (!in_array(\\$host, \\$trustedHosts, true)) {"
    condition:
        $vuln_code and not $safe_code
}

Sigma Rule

title: CVE-2024-25625 - Pimcore Host Header Injection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects suspicious Host header in Pimcore invitation requests
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/admin/user/invitationlink'
        cs-host: 
            - 'evil.com'
            - 'phishing.net'
    condition: selection
falsepositives:
    - Legitimate multi-domain setups
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-25625 - Pimcore Host Header Injection"; flow:to_server; http.method; content:"POST"; http.uri; content:"/admin/user/invitationlink"; http.host; content:"!"; pcre:"/Host:\s*(?!target-pimcore\.com)/Hi"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade pimcore/admin-ui-classic-bundle to version 1.3.4 or later.
2. Configure trusted hosts in config.yml:

   pimcore:
       admin:
           trusted_hosts: ['yourdomain.com', 'admin.yourdomain.com']
           default_host: 'yourdomain.com'
   

3. Restrict access to the invitation endpoint via firewall or WAF rules.

Long-term Measures:

• Implement strict input validation for all HTTP headers.
• Use a reverse proxy (e.g., Nginx) to strip or validate Host headers.
• Conduct regular security audits of third-party dependencies.

Workaround (if patching is not immediate):

• Disable the invitation feature temporarily.
• Manually validate the Host header in a custom middleware.

Valters IT - DevSecOps & Cyber Threat Intelligence