GHSA-3735-5339-xfwx

Summary

Poweradmin v4.3.2 uses the attacker-controlled HTTP_HOST request header as the authoritative source for building callback URLs in its OIDC, SAML, and logout authentication flows without any validation. An unauthenticated attacker can poison the redirect_uri sent to the Identity Provider, causing the IdP to redirect the victim's authorization code to an attacker-controlled server - resulting in full account takeover with no credentials required.

Three independent code paths are affected:

• Primary (Critical): OidcService::getCallbackUrl() - redirect_uri poisoning
• Secondary (High): SamlConfigurationService::getBaseUrl() - SAML ACS/SLO URL poisoning
• Tertiary (Medium): LogoutController::getBaseUrl() - post-logout redirect poisoning

Details

Root Cause

The application constructs absolute URLs dynamically from HTTP_HOST rather than from a trusted configured base URL. The header is fully client-controlled and is not validated before use in any authentication flow.

Poweradmin's own codebase contains the correct pattern - DocsController::getValidatedHost() (line 244) calls isValidHostname() before using the value - but this was never applied to authentication flows.

### Primary: lib/Application/Service/OidcService.php (~line 460)

```php private function getCallbackUrl(): string { $scheme = $this->detectScheme(); // HTTPHOST taken directly with zero validation $host = $this->request->getServerParam('HTTPHOST', 'localhost'); $basePrefix = $this->configManager->get('interface', 'baseurlprefix', ''); return $scheme . '://' . $host . $basePrefix . '/oidc/callback'; }

HTTPHOST is embedded verbatim as redirecturi in the OAuth 2.0 authorization request sent to the IdP. HTTPXFORWARDED_PROTO is similarly used unvalidated for scheme detection.

Secondary: lib/Application/Service/SamlConfigurationService.php (~line 134)

private function getBaseUrl(): string { $configuredBaseUrl = $this->configManager->get('interface', 'base_url', ''); if (!empty($configuredBaseUrl)) { return rtrim($configuredBaseUrl, '/'); // safe path - rarely configured } // Falls through on every default installation $host = $SERVER['HTTPHOST'] ?? 'localhost'; ... return $scheme . '://' . $host . $prefix; }

Used to construct SAML ACS URL, SLO URL, and entity ID - all poisonable via Host header. The safe fallback only activates when interface.base_url is explicitly set, which is optional and empty by default.

Tertiary: lib/Application/Controller/LogoutController.php (~line 272)

Same $SERVER['HTTPHOST'] pattern used for post-logout redirect URL construction.

PoC

Environment: Poweradmin v4.3.2, Docker, PHP 8.2, OIDC enabled, interface.base_url empty (default).

docker exec poweradmin-container php -r " require '/app/vendor/autoload.php'; putenv('PACONFIGPATH=/app/config/settings.php');

use PowerAdmin\Application\Service\OidcService; use PowerAdmin\Infrastructure\Configuration\ConfigurationManager; use PowerAdmin\Infrastructure\Web\Request;

\$SERVER['HTTPHOST'] = 'attacker.com'; \$_SERVER['HTTPS'] = '';

\$config = ConfigurationManager::getInstance(); \$request = new Request(); \$oidcService = new OidcService(\$config, \$request); \$authUrl = \$oidcService->initiateAuthFlow('test');

parsestr(parseurl(\$authUrl, PHPURLQUERY), \$p); echo 'redirecturi: ' . urldecode(\$p['redirecturi']) . PHP_EOL;

if (strcontains(\$p['redirecturi'], 'attacker.com')) { echo '[CONFIRMED] Host header injection successful' . PHP_EOL; } "

Output:

redirect_uri: http://attacker.com/oidc/callback

[CONFIRMED] Host header injection successful - redirect_uri contains attacker.com

The redirect_uri in the authorization request sent to the Identity Provider is http://attacker.com/oidc/callback. The victim's authorization code will be delivered to this URL upon successful authentication.

Note on PKCE: PKCE does not mitigate this attack. The attacker initiates the flow themselves and controls both codechallenge and codeverifier.

Impact

Direct Impact

An attacker who can send a request with a spoofed Host header - directly or via a misconfigured reverse proxy (proxysetheader Host $http_host is the nginx default) - can steal any user's authorization code and gain full authenticated access to Poweradmin. No credentials, malware, or prior access required.

DNS Infrastructure Impact

Poweradmin manages PowerDNS. A compromised administrator account grants full DNS zone control, enabling:

• MX hijacking - redirect all inbound email to attacker's mail server; intercept password reset emails and 2FA codes for any third-party service registered with the domain
• SPF/DKIM manipulation - add attacker's IP to SPF, publish attacker's DKIM key → send cryptographically authenticated email as the organization (passes DMARC)
• Subdomain takeover - point mail., vpn., app. to attacker infrastructure
• SSL certificate theft - remove CAA records and complete ACME DNS-01 challenge to obtain wildcard certificate *.company.com from any CA

• Full domain delegation - delegate subdomains to attacker nameserver

  CVSS v3.1

  ┌──────────────────────────────────┬─────────────────────────────────────┬──────────────┐ │ Scenario │ Vector │ Score │ ├──────────────────────────────────┼─────────────────────────────────────┼──────────────┤ │ Standard deployment │ AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L │ 8.2 High │ ├──────────────────────────────────┼─────────────────────────────────────┼──────────────┤ │ Proxy misconfigured ($http_host) │ AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L │ 9.3 Critical │ └──────────────────────────────────┴─────────────────────────────────────┴──────────────┘

  Recommended Fix

  Immediate mitigation: Set interface.base_url in config/settings.php - activates the safe branch in SamlConfigurationService immediately.

  Code fix for OidcService: Prefer the configured base URL; if absent, validate HTTPHOST via filtervar($hostname, FILTERVALIDATEDOMAIN, FILTERFLAGHOSTNAME) before use - the same pattern already implemented in DocsController::getValidatedHost().