CyberArk Privileged Access Manager Self-Hosted Host Header Injection Vulnerability Leading to Open Redirect

A host header injection vulnerability has been identified in CyberArk Privileged Access Manager Self-Hosted (PVWA) versions prior to 14.4. This vulnerability allows for open redirection by improperly handling the 'Host' header, which can be manipulated to redirect users to an attacker-controlled domain. The issue arises from environmental misconfigurations that contribute to host header injection.

Impact

Exploitation of this vulnerability could lead to open redirection, allowing attackers to redirect users to malicious sites, potentially capturing session tokens or credentials. In an advanced phishing scenario, attackers could impersonate a legitimate site to steal information or manipulate critical data.

Reproduction

The vulnerability can be reproduced by sending an HTTP request to the PVWA application with a manipulated 'Host' header. This can be done using tools like 'curl' or Burp Suite. Once the request is sent, the server responds with a 301 Moved Permanently status, redirecting the user to the domain specified in the 'Host' header, demonstrating the open redirect vulnerability.

Remediation

It is recommended to validate the 'Host' header on the server side, ensuring that redirections only point to legitimate, configured domains. Disabling host-based redirections if not required and using a whitelist of allowed domains for redirections can also help mitigate this vulnerability.