Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-25355

CVE-2022-25355: EC-CUBE improperly handles HTTP Host header values

5.3

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-25355
GHSA ID
GHSA-pw97-6v74-9w3p
EPSS Score
0.76617%
CWE
CWE-862
Published
2/25/2022
Updated
4/25/2024
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
ec-cube/ec-cubecomposer>= 3.0.0, <= 3.0.18-p3
ec-cube/ec-cubecomposer>= 4.0.0, <= 4.1.14.1.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from missing Host header validation. The patch for EC-CUBE 3.x explicitly adds Symfony's setTrustedHosts() call in index.php and index_dev.php to enforce host whitelisting. Vulnerable versions omitted this validation, allowing attackers to forge URLs via malicious Host headers. The absence of these function calls directly correlates with the improper Host header handling described in CVE-2022-25355.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

**-*U** *.*.* to *.*.**-p* *n* **-*U** *.*.* to *.*.* improp*rly **n*l* *TTP *ost *****r v*lu*s, w*i** m*y l*** * r*mot* un*ut**nti**t** *tt**k*r to *ir**t t** vuln*r**l* v*rsion o* **-*U** to s*n* *n *m*il wit* som* *or*** r*issu*-p*sswor* URL to **

Reasoning

T** vuln*r**ility st*ms *rom missin* *ost *****r v*li**tion. T** p*t** *or **-*U** *.x *xpli*itly ***s Sym*ony's `s*tTrust***osts()` **ll in `in**x.p*p` *n* `in**x_**v.p*p` to *n*or** *ost w*it*listin*. Vuln*r**l* v*rsions omitt** t*is v*li**tion, *l