Magento's X-Original-Url header can expose admin url
The advisory, in context
Impact
The admin url can be discovered without prior knowledge of it's location by exploiting the X-Original-Url header on some configurations.
Patches
The bug comes from the Zend library and is patche by unsetting the header in the bootstrap process.
Workarounds
Unset the X-Original-Url header in the web server configuration.
References
The activation of these headers is coming from the Zend_Controller module. It appears this has been known to some degree since 2016 - https://peterocallaghan.co.uk/2016/12/magento-poisoning-cache/ (dead link now..)
Credit
Anees Hyder ( @anees0xdev ) via HackerOne https://hackerone.com/anees0x_dev/hacktivity
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
Earlier releases before 20.16.1
Fixed in 20.16.1
90 explicitly affected versions
1.9.1.1, 1.9.2.0, 1.9.2.1, 1.9.2.2, 1.9.2.3, 1.9.2.4, 1.9.3.0, 1.9.3.1, v19.4.0, v19.4.1, v19.4.10, v19.4.11, v19.4.12, v19.4.13, v19.4.14, v19.4.15, v19.4.16, v19.4.17, v19.4.18, v19.4.19, v19.4.2, v19.4.20, v19.4.21, v19.4.22, v19.4.23, v19.4.3, v19.4.4, v19.4.5, v19.4.6, v19.4.7, v19.4.8, v19.4.9, v19.5.0, v19.5.0-rc1, v19.5.0-rc2, v19.5.0-rc3, v19.5.0-rc4, v19.5.0-rc5, v19.5.1, v19.5.2, v19.5.3, v20.0.0, v20.0.1, v20.0.10, v20.0.11, v20.0.12, v20.0.13, v20.0.14, v20.0.15, v20.0.16, v20.0.17, v20.0.18, v20.0.19, v20.0.2, v20.0.20, v20.0.3, v20.0.4, v20.0.5, v20.0.6, v20.0.7, v20.0.8, v20.1.0, v20.1.0-rc1, v20.1.0-rc2, v20.1.0-rc3, v20.1.0-rc4, v20.1.0-rc5, v20.1.0-rc6, v20.1.0-rc7, v20.1.1, v20.10.0, v20.10.1, v20.10.2, v20.11.0, v20.12.0, v20.12.1, v20.12.2, v20.12.3, v20.13.0, v20.14.0, v20.15.0, v20.16.0, v20.2.0, v20.3.0, v20.4.0, v20.5.0, v20.6.0, v20.7.0, v20.8.0, v20.9.0
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "20.16.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.9.1.1",
"1.9.2.0",
"1.9.2.1",
"1.9.2.2",
"1.9.2.3",
"1.9.2.4",
"1.9.3.0",
"1.9.3.1",
"v19.4.0",
"v19.4.1",
"v19.4.10",
"v19.4.11",
"v19.4.12",
"v19.4.13",
"v19.4.14",
"v19.4.15",
"v19.4.16",
"v19.4.17",
"v19.4.18",
"v19.4.19",
"v19.4.2",
"v19.4.20",
"v19.4.21",
"v19.4.22",
"v19.4.23",
"v19.4.3",
"v19.4.4",
"v19.4.5",
"v19.4.6",
"v19.4.7",
"v19.4.8",
"v19.4.9",
"v19.5.0",
"v19.5.0-rc1",
"v19.5.0-rc2",
"v19.5.0-rc3",
"v19.5.0-rc4",
"v19.5.0-rc5",
"v19.5.1",
"v19.5.2",
"v19.5.3",
"v20.0.0",
"v20.0.1",
"v20.0.10",
"v20.0.11",
"v20.0.12",
"v20.0.13",
"v20.0.14",
"v20.0.15",
"v20.0.16",
"v20.0.17",
"v20.0.18",
"v20.0.19",
"v20.0.2",
"v20.0.20",
"v20.0.3",
"v20.0.4",
"v20.0.5",
"v20.0.6",
"v20.0.7",
"v20.0.8",
"v20.1.0",
"v20.1.0-rc1",
"v20.1.0-rc2",
"v20.1.0-rc3",
"v20.1.0-rc4",
"v20.1.0-rc5",
"v20.1.0-rc6",
"v20.1.0-rc7",
"v20.1.1",
"v20.10.0",
"v20.10.1",
"v20.10.2",
"v20.11.0",
"v20.12.0",
"v20.12.1",
"v20.12.2",
"v20.12.3",
"v20.13.0",
"v20.14.0",
"v20.15.0",
"v20.16.0",
"v20.2.0",
"v20.3.0",
"v20.4.0",
"v20.5.0",
"v20.6.0",
"v20.7.0",
"v20.8.0",
"v20.9.0"
]
}