N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-95wr-3f2v-v2wh

GHSA-95wr-3f2v-v2wh: Craft CMS has a host header injection leading to SSRF via resource-js endpoint

Summary

The resource-js endpoint in Craft CMS allows unauthenticated requests to proxy remote JavaScript resources. When trustedHosts is not explicitly restricted (default configuration), the application trusts the client-supplied Host header.

This allows an attacker to control the derived baseUrl, which is used in prefix validation inside actionResourceJs(). By supplying a malicious Host header, the attacker can make the server issue arbitrary HTTP requests, leading to Server-Side Request Forgery (SSRF).

Details

The vulnerability exists in AppController::actionResourceJs().

The function validates that the url parameter starts with assetManager->baseUrl. However, baseUrl is derived from the current request host. If trustedHosts is not configured, the Host header is fully attacker-controlled.

Attack chain:

Attacker sends request with controlled Host header.
Application derives baseUrl from the malicious Host.
url parameter is required to start with this baseUrl.
Validation passes.
Guzzle performs a server-side HTTP request to the attacker-controlled host.
SSRF occurs.

This does not rely on string parsing bypass. It relies on Host header trust.

PoC (safe reproduction steps)

Environment:

Craft CMS 5.9.12
Default configuration (no trustedHosts restriction)
Docker deployment

Start a listener inside the container: python3 -m http.server 9999
Send a request to resource-js with a controlled Host header.
Observe that the internal listener receives a request (OOB confirmation).

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-95wr-3f2v-v2wh

GHSA-95wr-3f2v-v2wh:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
craftcms/cms	composer	>= 5.0.0-RC1, <= 5.9.14	5.9.15
craftcms/cms	composer	>= 4.0.0-RC1, <= 4.17.8	4.17.9

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability description explicitly identifies AppController::actionResourceJs() as the source of the SSRF. The provided commit patch confirms this by showing the removal of the line $response = Craft::createGuzzleClient()->get($url); from this function. The vulnerability arises because the application trusts the client-supplied Host header to construct the baseUrl for validation, which is an ineffective check. An attacker can supply a malicious Host header, causing the baseUrl to point to a domain they control. The subsequent check str_starts_with($url, ...) will then pass, leading to an SSRF when Guzzle makes the request to the attacker-controlled URL. The patch replaces the remote request with a local file path resolution, thus mitigating the SSRF vulnerability.

Vulnerable functions

craft\controllers\AppController::actionResourceJs

src/controllers/AppController.php

The function `actionResourceJs` in `AppController` was vulnerable to Server-Side Request Forgery (SSRF). It accepted a URL from the user, performed a validation check against a `baseUrl` that could be manipulated by an attacker via the `Host` header, and then used Guzzle to make an HTTP GET request to the provided URL. This allowed an attacker to make the server issue arbitrary HTTP requests.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.