Mailcow: Dockerized Password Reset Link Manipulation Vulnerability Allowing Account Takeover

A vulnerability exists in mailcow: dockerized versions prior to 2025-01a, allowing attackers to exploit the password reset feature. By manipulating the Host HTTP header, an attacker can create a password reset link that directs to an attacker-controlled domain. If a user clicks this link, it could result in unauthorized account access. Mailcow version 2025-01a has addressed this vulnerability. As a temporary measure, users can disable the password reset feature by removing the 'Notification email sender' and 'Notification email subject' under System -> Configuration -> Options -> Password Settings.

Impact

Exploitation of this vulnerability could lead to unauthorized account access.

Remediation

Users can update to mailcow version 2025-01a or deactivate the password reset functionality by clearing 'Notification email sender' and 'Notification email subject' under System -> Configuration -> Options -> Password Settings.