Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.2
Silverstripe: Attackers can hijack your website's URLs
published 2 years ago
Summary
An attacker could trick visitors into visiting a different website by injecting a malicious URL into your site. This can happen if you're not using a reverse proxy server and your Silverstripe website is vulnerable. To fix, update your htaccess file with a simple fix.
What to do
- Update silverstripe framework to version 3.1.13.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | silverstripe | framework |
>= 3.1.0, < 3.1.13 Fix: upgrade to 3.1.13
|
Original advisory text
Silverstripe X-Forwarded-Host request hostname injection
A potential hostname injection vulnerability has been found which could allow attackers to alter url resolution.
If a request contains the X-Forwarded-Host HTTP header a website would then use its value in place of the actual HTTP hostname. In cases where caching is enabled, this could allow an attacker to potentially embed a remote url as the base_url for any site. This would then cause other visitors to the site to be redirected unknowingly.
This header is necessary for servers running behind a reverse proxy (such as nginx). Such servers are likely not vulnerable to this risk.
A fix has been merged into the default installer, although existing projects which do not run behind a reverse proxy should update their htaccess as below:
```
<IfModule mod_headers.c>
# Remove X-Forwarded-Host header sent as a part of any request from the web
RequestHeader unset X-Forwarded-Host
</IfModule>
```
If a request contains the X-Forwarded-Host HTTP header a website would then use its value in place of the actual HTTP hostname. In cases where caching is enabled, this could allow an attacker to potentially embed a remote url as the base_url for any site. This would then cause other visitors to the site to be redirected unknowingly.
This header is necessary for servers running behind a reverse proxy (such as nginx). Such servers are likely not vulnerable to this risk.
A fix has been merged into the default installer, although existing projects which do not run behind a reverse proxy should update their htaccess as below:
```
<IfModule mod_headers.c>
# Remove X-Forwarded-Host header sent as a part of any request from the web
RequestHeader unset X-Forwarded-Host
</IfModule>
```
References
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-601Open Redirect
Timeline
Published23 May 2024
Updated6 Mar 2026
First seen6 Mar 2026
Sources
GHSA-25gq-jvx2-vg9x · GHSA
Track software like this
Free during beta