Vulnerability · Published Nov 11, 2021 · Assigned by Mend

CVE-2021-25980Talkyard - Host-Header Injection Leads to Account Takeover

High 8.8

In plain English

A high-severity injection in talkyard from debiki. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)1.3%top 30.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

In Talkyard, versions v0.04.01 through v0.6.74-WIP-63220cb, v0.2020.22-WIP-b2e97fe0e through v0.2021.02-WIP-879ef3fe1 and tyse-v0.2021.02-879ef3fe1-regular through tyse-v0.2021.28-af66b6905-regular, are vulnerable to Host Header Injection. By luring a victim application-user to click on a link, an unauthenticated attacker can use the “forgot password” functionality to reset the victim’s password and successfully take over their account.

Affected products (as reported)

Vendor	Product	Versions
debiki	talkyard	v0.04.01 – before v0v0.2020.22-WIP-b2e97fe0e – before v0.2020v0.2021 – through v0.2021.02-WIP-879ef3fe1tyse-v0.2021.02-879ef3fe1-regular – before tyse-v0.2021*

Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://github.com/debiki/talkyard/commit/4067e191a909ed06f250d09a40e43aa5edbb0289 x_refsource_MISC
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25980 x_refsource_MISC