Executive Summary

This vulnerability exists in ApostropheCMS versions up to and including 4.29.0. The password reset flow constructs the reset URL using the hostname from the HTTP Host header, which an attacker can control if the base URL is not explicitly configured. An unauthenticated attacker who knows a victim's email can send a crafted password reset request that causes the victim to receive a reset link pointing to the attacker's domain.

When the victim clicks the malicious reset link, the valid reset token is sent to the attacker, allowing the attacker to take over the victim's account.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to full account takeover by an attacker without requiring authentication. The attacker can gain unauthorized access to user accounts by tricking victims into clicking a malicious password reset link.

Such an account compromise can result in loss of sensitive data, unauthorized actions performed on behalf of the victim, and potential further exploitation within the affected system.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, explicitly configure the `apos.baseUrl` setting in ApostropheCMS to ensure the password reset URL is constructed using a trusted domain rather than relying on the HTTP Host header.

Since no patched versions are available as of the publication date, this configuration change is critical to prevent attackers from crafting reset links that point to malicious domains.

Useful 0 Not Useful 0