CVE-2021-30185

Vulnerability

CERN Indico versions before 2.3.4 are vulnerable to a host header injection in the password reset functionality. The application uses the Host header supplied by the user to construct the password reset link without proper validation or sanitization. This allows an attacker to manipulate the reset link by providing a malicious Host header. [1][3]

Exploitation

An attacker with network access to the Indico instance can send a password reset request with a spoofed Host header pointing to a domain they control. The application then generates a password reset link containing that domain, which is emailed to the target user. If the user clicks the link, the attacker can intercept the reset token and complete the password change. No authentication is required for the attack, and no special privileges are needed. [1][3]

Impact

Successful exploitation allows the attacker to take over the target user's account by obtaining the password reset token. This leads to complete compromise of the affected account, including access to any data or functionality associated with that user's role in Indico. The attack targets the confidentiality and integrity of user accounts. [1][3]

Mitigation

The vulnerability is fixed in Indico version 2.3.4, released on 2021-04-07. Users should upgrade to this version or later. No workarounds are available. [1][3]