EUVD-2025-208707
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Lifecycle Timeline
3Description
Raytha CMS allows an attacker to spoof `X-Forwarded-Host` or `Host` headers to attacker controlled domain. The attacker (who knows the victim's email address) can force the server to send an email with password reset link pointing to the domain from spoofed header. When victim clicks the link, browser sends request to the attacker’s domain with the token in the path allowing the attacker to capture the token. This allows the attacker to reset victim's password and take over the victim's account. This issue was fixed in version 1.4.6.
Analysis
A host header injection vulnerability in Raytha CMS allows attackers to hijack password reset tokens by spoofing X-Forwarded-Host or Host headers, leading to account takeover. The vulnerability affects all versions prior to 1.4.6 and requires only that the attacker knows the victim's email address to initiate the attack chain. With a CVSS 7.5 score and requiring user interaction, this represents a significant authentication bypass risk for organizations using the affected CMS versions.
Technical Context
Raytha CMS is a content management system that improperly validates host headers when generating password reset links, falling under CWE-348 (Use of Less Trusted Source). The application trusts user-controlled headers (X-Forwarded-Host or Host) when constructing URLs for password reset emails, allowing an attacker to inject their own domain. This is a common vulnerability pattern in web applications that generate absolute URLs based on incoming HTTP headers without proper validation, particularly problematic in multi-tenant or reverse proxy environments where these headers are commonly used.
Affected Products
Raytha CMS versions prior to 1.4.6 are vulnerable to this host header injection attack. The vulnerability was discovered and reported to the vendor, who released version 1.4.6 containing the fix. Organizations running any version of Raytha CMS below 1.4.6 should consider their installations at risk for account takeover attacks through manipulated password reset flows.
Remediation
Upgrade Raytha CMS to version 1.4.6 or later immediately to address this vulnerability. Until patching is possible, consider implementing additional email validation for password reset requests, such as requiring users to confirm reset requests through a separate channel or implementing rate limiting on password reset functionality. Organizations should also monitor for unusual password reset activity and educate users about the risks of clicking unexpected password reset links.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today