CVE-2021-21265
published 2021-03-10CVE-2021-21265: October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October before version 1.1.2, when running on poorly configured…
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCNIHAN
EPSS
1.51%
71.3th percentile
October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October before version 1.1.2, when running on poorly configured servers (i.e. the server routes any request, regardless of the HOST header to an October CMS instance) the potential exists for Host Header Poisoning attacks to succeed. This has been addressed in version 1.1.2 by adding a feature to allow a set of trusted hosts to be specified in the application. As a workaround one may set the configuration setting cms.linkPolicy to force.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| october | backend | >= 0 < 1.1.2 | 1.1.2 |
| octobercms | october | < 1.1.2 | 1.1.2 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
October CMS vulnerable to Potential Host Header Poisoning on misconfigured servers
osv·2021-03-10
CVE-2021-21265 [LOW] October CMS vulnerable to Potential Host Header Poisoning on misconfigured servers
October CMS vulnerable to Potential Host Header Poisoning on misconfigured servers
### Impact
When running on servers that are configured to accept a wildcard as a hostname (i.e. the server routes any request, regardless of the HOST header to an October CMS instance) the potential exists for Host Header Poisoning attacks to succeed. See the following resources for more information on Host Header Poisoning:
- https://portswigger.net/web-security/host-header
- https://dzone.com/articles/what-is-a-host-header-attack
### Patches
A feature has been added in v1.1.2 to allow a set of trusted hosts to be specified in the application.
### Workarounds
- Apply https://github.com/octobercms/library/commit/f86fcbcd066d6f8b939e8fe897409d152b11c3c6 & https://github.com/octobercms/october/commit/f638
GHSA
October CMS vulnerable to Potential Host Header Poisoning on misconfigured servers
ghsa·2021-03-10
CVE-2021-21265 [LOW] CWE-644 October CMS vulnerable to Potential Host Header Poisoning on misconfigured servers
October CMS vulnerable to Potential Host Header Poisoning on misconfigured servers
### Impact
When running on servers that are configured to accept a wildcard as a hostname (i.e. the server routes any request, regardless of the HOST header to an October CMS instance) the potential exists for Host Header Poisoning attacks to succeed. See the following resources for more information on Host Header Poisoning:
- https://portswigger.net/web-security/host-header
- https://dzone.com/articles/what-is-a-host-header-attack
### Patches
A feature has been added in v1.1.2 to allow a set of trusted hosts to be specified in the application.
### Workarounds
- Apply https://github.com/octobercms/library/commit/f86fcbcd066d6f8b939e8fe897409d152b11c3c6 & https://github.com/octobercms/october/commit/f638
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/octobercms/library/commit/f29865ae3db7a03be7c49294cd93980ec457f10dhttps://github.com/octobercms/library/commit/f86fcbcd066d6f8b939e8fe897409d152b11c3c6https://github.com/octobercms/october/commit/555ab61f2313f45d7d5d138656420ead536c5d30https://github.com/octobercms/october/commit/f638d3f78cfe91d7f6658820f9d5e424306a3db0https://github.com/octobercms/october/security/advisories/GHSA-xhfx-hgmf-v6vphttps://packagist.org/packages/october/backendhttps://github.com/octobercms/library/commit/f86fcbcd066d6f8b939e8fe897409d152b11c3c6https://github.com/octobercms/october/commit/f638d3f78cfe91d7f6658820f9d5e424306a3db0https://github.com/octobercms/october/security/advisories/GHSA-xhfx-hgmf-v6vp
2021-03-10
Published