Miggo Logo

CVE-2022-29933: Improper account password reset in Craft CMS

8.8

CVSS Score
3.1

Basic Information

EPSS Score
0.84241%
Published
5/10/2022
Updated
2/1/2023
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
craftcms/cmscomposer< 3.7.363.7.36

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability occurs in the password reset email generation endpoint (/admin/actions/users/send-password-reset-email). The UsersController's sendPasswordResetEmailAction is responsible for processing reset requests. It improperly trusts the X-Forwarded-Host header when constructing password reset URLs, allowing attackers to poison the link's domain. This matches the described attack vector where header manipulation leads to token leakage. While exact code isn't available, Craft CMS's MVC structure and the documented attack pattern strongly indicate this controller action as the vulnerable component.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*r**t *MS t*rou** *.*.** *llows * r*mot* un*ut**nti**t** *tt**k*r, w*o knows *t l**st on* v*li* us*rn*m*, to r*s*t t** ***ount's p*sswor* *n* t*k* ov*r t** ***ount *y provi*in* * *r**t** *TTP *****r to t** *ppli**tion w*il* usin* t** p*sswor* r*s*t *

Reasoning

T** vuln*r**ility o**urs in t** p*sswor* r*s*t *m*il **n*r*tion *n*point (/**min/**tions/us*rs/s*n*-p*sswor*-r*s*t-*m*il). T** Us*rs*ontroll*r's s*n*P*sswor*R*s*t*m*il**tion is r*sponsi*l* *or pro**ssin* r*s*t r*qu*sts. It improp*rly trusts t** X-*or