Cythera Cyber Security

Silverstripe - Host Header Injection

Silverstripe CMS is affected by a Host Header Injection flaw, which can be exploited to manipulate password reset workflows, potentially redirecting or compromising user data.

Talk to an expert

Introduction

Silverstripe is a popular open-source CMS for creating and maintaining websites. During a client engagement, Jason Xie (Director SME at Bastion Security Group) identified a Host header injection vulnerability with a client’s environment, leading to an email being sent from the Silverstripe instance with a poisoned password reset URL. When the poisoned URL in the email was clicked, it would trigger account takeover.

The issue was reported to Silverstripe and was marked as web server a configuration issue. The vulnerability was identified during subsequent client engagements. Will Frame (Security Consultant at Bastion Security Group identified an instance where clicking the poisoned URL was not required. He decided to further investigate this issue, the mitigating factors, and how many servers on the internet were misconfigured.

The Vulnerability

In common Silverstripe configurations, user-supplied Host headers are used to construct URLs throughout the application. For example, the Host header may be used to generate links or buttons on a webpage.

One critical instance of this behaviour occurs in the password reset functionality. In November 2021, Jason Xie observed that when a user requested a password reset, the application used the value of the Host header to generate the reset link. An attacker could exploit this by crafting a password reset request for a victim, modifying the Host header to point to a server they control. If the victim clicks the link sent in the email, the password reset token is sent to the attacker’s server.

Will Frame identified an instance where, because the client was using Microsoft Outlook for their emails, the link was automatically clicked by Microsoft SafeLinks. This immediately sent the password reset token to the attacker's server without user interaction.

It should be noted that to carry out this attack, a valid email address for the target Silverstripe account must be known. Time-based enumeration could assist in the discovery of accounts.

In some cases, an X-Forwarded-For header with the user-controlled domain was required.

Further investigation

Will Frame further investigated the impact by checking Silverstripe sites identified on the web to see whether requests to the front page with arbitrary Host headers were rejected, and whether the “LostPassword” page was accessible without authentication. Of 2,511 sites checked,1,305 accepted arbitrary Host headers and had the lost password page accessible without authentication, meaning the majority of the Silverstripe sites were vulnerable. Of these 1,305 vulnerable sites, 207 used Microsoft as their email hosting provider, which means that the password reset token could be retrieved without any user interaction due to the SafeLinks issue. It should be noted that certain MX records, which are not directly linked to Outlook, appeared to route emails through Microsoft Outlook, where they are subsequently processed by SafeLinks. These sites are not included in the numbers above.

‍

How to fix it

Silverstripe recommends adding to the list ofallowed hosts in the .env file, to ensure arbitrary Host headers cannot be usedwith the Silverstripe instance. More detail can be found here.

Additionally, MFA should be implemented for all administrator accounts, along with proper rate-limiting to prevent the brute-forcing of a one-time passcode orenumerating a user account through time-based enumeration.

‍

Vulnerability disclosure timeline

21/10/2021 Issue first reported to Silverstripe
22/10/2021 Further code analysis reported to Silverstripe
26/10/2021 CVE-2021-43031created
18/11/2021 SilverStripe final decision: “We’ve decided that we’ll treat this as a security enhancement in the open instead of as a regular security issue. This is because it relies on a server to not be following standard security practices for it to be exploitable”
01/10/2024 Zero-click Safe Links issue identified
14/11/2024 Further research began after identifying the issue in multiple client engagements
16/11/2024 2,511 sites checked with 1,305 accepting arbitrary Host headers, further research continued
03/12/2024 Reported toCERT/NCSC, including a list of vulnerable New Zealand sites
21/01/2025 Advisory released with approval from CERT

CIO

Government Agency

Cythera operates as an extension of our team. When we call there is an immediate response and the person that answers our call is the person that resolves our issue. Cythera understands our network, and more importantly, has taken the time to understand our business. We find it easy to work with Cythera. They are approachable, flexible and have taken the time to build deep relationships with our team. It is a partnership and friendship. Cythera’s personalised, highly specialised services makes all the difference. We would recommend Cythera to anyone in the industry looking for a managed services partner.

Expert methods

We have the tools to pinpoint risks

Whether it’s hidden vulnerabilities or patterns you might miss, we help you stay one step ahead and make confident, informed decisions. Understand how our services can help your business uncover critical risks

Talk to an expert

Employee Cyber Training & Awareness

Your people are your first line of defence. Our cyber training builds awareness sharpens instincts and turns everyday staff into assets.

Advisory

When clarity is critical and stakes are high, our advisory services deliver strategic, executive-level security expertise that empowers decision-making and resilient operations.

Are you experiencing a security breach?

Incident Response