Medium, CVSS 5.3PyPIAmendedPublished
Invenio-App vulnerable to host header injection attack
CVE-2019-1020006 · GHSA-94mf-xfg5-r247
- Affected
- PyPI invenio-app < 1.0.6; >= 1.1.0, <= 1.1.0
- Fixed in
- 1.0.61.1.1· Vendor fix available
- Issue
- APPALLOWEDHOSTS not always preventing host header injection Impact A possible host header injection attack have been identified in Invenio-App. For an attack to be possible, all conditions below must be met: 1. Your webserver must have been configured to route all requests to your application. 2. You must have relied on APPALLOWEDHOSTS configuration variable to whitelist allowed host headers. 3. Flask's request.host must not have been evaluated during request handling. An example of a view which does not evalute request.host is a simple view using just urlfor to generate an external URL (similar is possible when rendering just a Jinja template): This happens, because Werkzeug's trusted host feature, which APPALLOWEDHOSTS rely on, does not check the the list of trusted hosts in it's routing system that urlfor is relying on. Patches Invenio-App v1.0.6 and v1.1.1 fully fix the issue. Note, we strongly recommend (see Securing your instance) that you never route requests to your…
Recommended action: Upgrade to 1.1.1 or 1.0.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.