CVE-2022-33012

Vulnerability

Overview

CVE-2022-33012 affects Microweber v1.2.15, a drag-and-drop website builder and CMS built on the PHP Laravel framework [1]. The vulnerability allows attackers to perform a host header injection attack, which can be used to conduct password reset poisoning and ultimately achieve account takeover [2][3]. The root cause is the application's failure to validate or sanitize the HTTP Host header when generating password reset emails, allowing an attacker to inject a malicious domain into the reset link [2][4].

Exploitation

Method

To exploit this vulnerability, an attacker intercepts the password reset request for a target victim and manipulates the Host header (or related headers like X-Forwarded-Host) to point to an attacker-controlled domain [2][4]. The application then generates a password reset email that includes a link using the spoofed host header. When the victim clicks the malicious link, the password reset token (typically included as a URL parameter) is either sent to the attacker's server or can be intercepted if the attacker hosts a phishing page at the spoofed domain [2][4]. No authentication is required for this attack; the attacker only needs to know the victim's email address and the ability to intercept or craft HTTP requests to the Microweber server.

Impact

Successful exploitation allows an attacker to obtain a valid password reset token for the victim's account. With this token, the attacker can reset the victim's password and log in as that user, effectively taking over the account [2][3]. This can lead to unauthorized access to sensitive user data, administrative control if the victim is an admin, and potential compromise of the entire Microweber site.

Mitigation

Status

The vulnerability was disclosed through a security researcher's blog post and confirmed by the vendor [3]. As of the publication date (November 22, 2022), users are advised to upgrade to a patched version of Microweber or implement workarounds such as strictly validating the Host header against a whitelist of allowed server names [2][4]. The current stable version (2.0) may have addressed this issue, but users running v1.2.15 or earlier should apply updates immediately.