Executive Summary

This vulnerability in ClipBucket v5.5.2 occurs because the application dynamically builds the server URL from the HTTP Host header when the base_url configuration is not set. Since the Host header is controlled by the client, an attacker can supply a malicious Host value. This causes password-reset links to be generated with the attacker's domain. If a victim clicks the link and enters their activation code on the attacker's domain, the attacker can capture the code and reset the victim's password, leading to account takeover.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to account takeover by allowing an attacker to intercept password-reset activation codes. This compromises user accounts, potentially exposing sensitive personal information and allowing unauthorized actions within the affected ClipBucket platform.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, immediately update ClipBucket to version 5.5.2#162 or later where the issue is patched. Additionally, ensure that the configuration parameter base_url is properly set to prevent the application from dynamically building the server URL from the incoming HTTP Host header.

Useful 0 Not Useful 0