Summary
Host header injection in the password reset
The password reset functionality sends to the the user requesting a password change an email containing an URL to reset its password.
The URL sent contains a unique token, valid during 24 hours, allowing the user to reset its password.
This token is highly sensitive ; as an attacker able to retrieve it would be able to resets the user's password.
It was identified during the audit that the reset-password URL is crafted using the "Host" HTTP header of the request sent to request a password reset.
This way, an external attacker could send password requests for users, but specify a "Host" header of a website that they control.
If the user receiving the mail clicks on the link, the attacker would retrieve the reset token of the victim and perform account takeover.
Details
This attack required the server to serve Pimcore on arbitrary "Host". This configuration would be plausible if the attacker is already behind the reverse proxy.
During the assessment of my client, their instance was accepting any Host header, and they did not received security recommendations that they should restrict this while installing Pimcore.
From what I understood of Pimcore, the vulnerability is in the "admin-ui-classic-bundle", in the file src/Controller/Admin/UserController.php.
The following screenshots provide evidences of the vulnerability. The environment of the test is : dockerized Pimcore v11.1.1 on default configuration (https://pimcore.com/docs/platform/Pimcore/Getting_Started/Installation/Docker_Based_Installation/).
PoC
Impact
Could lead to a 1-click account takeover
CVE-2024-23648 has a CVSS score of 8.8 (High). The vector is network-reachable, no privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (1.2.3); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Create a variable that sets the server host.
Don't enable password reset functionality while this variable is not set ; or make sure that the administrator knows what they are doing.
I believe that just documenting that the server should not serve on any Host would not be enough to enforce a remediation to this vulnerability.
The Snipe-IT project managed this same issue by creating a "APP_ALLOW_INSECURE_HOSTS" variable, and retrieving the app absolute URL from a config file : https://github.com/snipe/snipe-it/commit/0c4768fd2a11ac26a61814cef23a71061bfd8bcc
Frequently Asked Questions
- What is CVE-2024-23648? CVE-2024-23648 is a high-severity security vulnerability in pimcore/admin-ui-classic-bundle (composer), affecting versions < 1.2.3. It is fixed in 1.2.3.
- How severe is CVE-2024-23648? CVE-2024-23648 has a CVSS score of 8.8 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of pimcore/admin-ui-classic-bundle are affected by CVE-2024-23648? pimcore/admin-ui-classic-bundle (composer) versions < 1.2.3 is affected.
- Is there a fix for CVE-2024-23648? Yes. CVE-2024-23648 is fixed in 1.2.3. Upgrade to this version or later.
- Is CVE-2024-23648 exploitable, and should I be worried? Whether CVE-2024-23648 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2024-23648 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2024-23648? Upgrade
pimcore/admin-ui-classic-bundleto 1.2.3 or later.