Summary
A vulnerability in Craft's process-api-response-headers action allows an authenticated control panel user with accessCp permission to inject newline characters into a trusted API response header. This can alter the generated environment configuration, replace the Craft security key, and may enable forged signed redirects that execute server-side functionality.
A vulnerability in Craft's process-api-response-headers action allows an authenticated control panel user with accessCp permission to inject newline characters into a trusted API response header. This can alter the generated environment configuration, replace the Craft security key, and may enable forged signed redirects that execute server-side functionality.
Affected context
The issue occurs when Craft accepts API response headers as trusted input and writes the X-Craft-Plugin-Licenses value into the .env file without removing embedded newline characters. Affected deployments are those where a non-administrative authenticated control panel user has accessCp permission and can cause the response-header processing path to run.
The issue occurs when Craft accepts API response headers as trusted input and writes the X-Craft-Plugin-Licenses value into the .env file without removing embedded newline characters. Affected deployments are those where a non-administrative authenticated control panel user has accessCp permission and can cause the response-header processing path to run.
Exploit preconditions
- Attack surface: Craft control panel API response-header processing - Required access: An authenticated control panel account with accessCp
permission
- Trigger point: Processing of a crafted X-Craft-Plugin-Licenses response
header
- Why exploitation is possible: Embedded line breaks are preserved while the
value is written to the environment file, allowing security-sensitive
configuration data to be modified and subsequently trusted by Craft
- Attack surface: Craft control panel API response-header processing - Required access: An authenticated control panel account with accessCp
permission
- Trigger point: Processing of a crafted X-Craft-Plugin-Licenses response
header
- Why exploitation is possible: Embedded line breaks are preserved while the
value is written to the environment file, allowing security-sensitive
configuration data to be modified and subsequently trusted by Craft
Why this happens
The underlying bug is a failure to treat externally supplied HTTP header values as untrusted data before persisting them as environment configuration. Newline characters are not normalized or rejected, so a header value can cross a configuration boundary and introduce additional environment entries. This maps to CWE-94 because the resulting configuration change can influence later interpretation and execution of server-side template or callback behavior.
The underlying bug is a failure to treat externally supplied HTTP header values as untrusted data before persisting them as environment configuration. Newline characters are not normalized or rejected, so a header value can cross a configuration boundary and introduce additional environment entries. This maps to CWE-94 because the resulting configuration change can influence later interpretation and execution of server-side template or callback behavior.
Potential impact
- An attacker may replace the application's security key with a known value.
- An attacker could forge signed login redirects or other security-sensitive tokens.
- The vulnerability may enable unauthorized account access or privilege escalation.
- Server-side template functionality could be abused to execute commands.
- The application and its stored data may be compromised.
- An attacker may replace the application's security key with a known value.
- An attacker could forge signed login redirects or other security-sensitive tokens.
- The vulnerability may enable unauthorized account access or privilege escalation.
- Server-side template functionality could be abused to execute commands.
- The application and its stored data may be compromised.
General mitigation guidance
Mitigation generally focuses on preserving trust boundaries between HTTP metadata and configuration files. Header values should be treated as untrusted, with control characters rejected or safely normalized before any persistence. Configuration writers should use structured serialization rather than line-oriented string concatenation, and security-sensitive environment values should not be derived directly from request- or response-controlled data. Strict allowlists, immutable configuration paths, key rotation procedures, and least-privilege control panel roles can reduce exposure. Template and callback execution should also remain disabled or tightly constrained unless explicitly required.
Mitigation generally focuses on preserving trust boundaries between HTTP metadata and configuration files. Header values should be treated as untrusted, with control characters rejected or safely normalized before any persistence. Configuration writers should use structured serialization rather than line-oriented string concatenation, and security-sensitive environment values should not be derived directly from request- or response-controlled data. Strict allowlists, immutable configuration paths, key rotation procedures, and least-privilege control panel roles can reduce exposure. Template and callback execution should also remain disabled or tightly constrained unless explicitly required.
How teams detect issues like this
Detection can include static analysis for writes that concatenate HTTP header values into dotenv or other configuration formats, together with checks for missing control-character validation. Code review should examine trust-boundary crossings, security-key assignment, signed redirect generation, and any configuration reload following header processing. Runtime monitoring can alert on unexpected changes to environment files, security keys, or signed authentication artifacts. Policy enforcement in CI can require allowlisted header values and review of code that persists externally influenced data.
Detection can include static analysis for writes that concatenate HTTP header values into dotenv or other configuration formats, together with checks for missing control-character validation. Code review should examine trust-boundary crossings, security-key assignment, signed redirect generation, and any configuration reload following header processing. Runtime monitoring can alert on unexpected changes to environment files, security keys, or signed authentication artifacts. Policy enforcement in CI can require allowlisted header values and review of code that persists externally influenced data.
Sources
| Source | Link |
|---|---|
| github. | github.com/ |
| github. | github.com/ |
| github. | github.com/ |
| hckrt. | hckrt.com/ |
