Host Header Injection in Silverstripe
To carry out this attack, an attacker must first know a valid email address associated with the target Silverstripe account. According to previous disclosures, techniques such as time-based enumeration could help attackers discover valid accounts. In certain cases, including an X-Forwarded-For header containing a domain controlled by the attacker was necessary for exploitation.
Further Investigation
Security researcher Will Frame conducted an analysis of publicly available Silverstripe websites to evaluate the scope of exposure. He examined whether the sites accepted arbitrary Host headers and if the "Lost Password" page was publicly accessible.
Out of 2,511 Silverstripe sites tested:
- 1,305 sites accepted arbitrary Host headers and exposed the password reset page without requiring authentication.
- 207 of these used Microsoft email hosting, allowing for password reset tokens to be automatically retrieved via Microsoft's SafeLinks URL scanning feature — without any user interaction.
- It's also worth noting that some other mail servers, although not explicitly using Microsoft’s MX records, routed email through Outlook infrastructure, potentially exposing them to the same risk. These were not included in the tally.
Recommended Remediation
To prevent this vulnerability, Silverstripe recommends explicitly listing allowed Host values in the application's .env configuration file. This blocks requests with forged headers from reaching the application.
Additional best practices include:
- Enabling multi-factor authentication (MFA) for all administrator accounts.
- Applying rate-limiting to protect against one-time passcode brute-force attempts.
- Preventing account enumeration through timing attacks.
More technical guidance on these measures is available in Silverstripe’s secure coding documentation, MFA setup guide, and rate-limiting documentation.
Vulnerability Disclosure Timeline
- 21 Oct 2021 – Initial issue reported to Silverstripe.
- 22 Oct 2021 – Additional technical analysis submitted.
- 26 Oct 2021 – CVE-2021-43031 assigned.
- 18 Nov 2021 – Silverstripe classified the issue as a "security enhancement", citing that it depends on insecure server configurations to be exploited.
- 01 Oct 2024 – Discovery of the SafeLinks-related zero-click issue.
- 14–16 Nov 2024 – Further research across multiple clients revealed widespread exposure.
- 03 Dec 2024 – Issue reported to CERT/NCSC, along with a list of affected New Zealand websites.
- 21 Jan 2025 – Public advisory released with CERT approval.
