EJBCA Host Header Injection Vulnerability Allowing Redirection to Malicious Servers

A vulnerability in the EJBCA service, version 8.0 Enterprise, allows for manipulation of generated links by modifying the 'Host' header in an HTTP request. This could redirect clients to a different base URL, potentially leading to an attacker-controlled server that intercepts HTTP requests from the client.

Impact

Exploitation of this vulnerability could result in unauthorized redirection of client requests to an attacker-controlled server.

Remediation

Users are advised to update to EJBCA version 9.1. If running a reverse proxy, disable caching for the URL paths /ejbca/ra/ and /ejbca/adminweb/.