CVE-2021-21265: October/backend October CMS Vulnerable To Potential Vulnerability

Q: What is CVE-2021-21265?

CVE-2021-21265 is a security vulnerability in October/backend involving October CMS vulnerable to Potential Host Header Poisoning on misconfigured servers under CWE-644: Improper Neutralization of HTTP Headers for Scripting Syntax.

Q: Which October/backend versions are affected?

Affected versions include releases prior to 1.1.2 across affected packages: october/backend.

Q: What version fixes CVE-2021-21265?

Upgrading to 1.1.2 (or the latest patched release for your respective branch) resolves the vulnerability.

Q: Is october/backend affected?

Yes, october/backend is affected in releases prior to 1.1.2. Upgrade your dependency to 1.1.2 or later.

Q: What CWE is associated with CVE-2021-21265?

CVE-2021-21265 is classified under CWE-644: Improper Neutralization of HTTP Headers for Scripting Syntax (The product does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash.).

Q: How can I check Packagist dependencies for CVE-2021-21265?

Run the dependency tree command: 'inspect dependencies for october/backend'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

LOW

Advisory Identifier: GHSA-xhfx-hgmf-v6vp

CWE-644

Published 2021-03-10

Advisory Summary

CVE-2021-21265 is a LOW october cms vulnerable to potential vulnerability (CWE-644: Improper Neutralization of HTTP Headers for Scripting Syntax) affecting October/backend libraries in the Packagist ecosystem. The issue involves october cms vulnerable to potential host header poisoning on misconfigured servers. Remediation is available by upgrading affected packages to version 1.1.2.

CVE-2021-21265 at a Glance

CVE Identifier CVE-2021-21265

GHSA Identifier GHSA-xhfx-hgmf-v6vp

Severity LOW

CVSS v3.1 Base Score N/A

CWE Classification CWE-644: Improper Neutralization of HTTP Headers for Scripting Syntax

Affected Product October/backend

Package Ecosystem Packagist

Published Date 2021-03-10

Last Updated 2025-05-29

How to Fix CVE-2021-21265

To remediate this vulnerability, upgrade all affected October/backend dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

october/backend fixed: 1.1.2

Upgrade october/backend to 1.1.2

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

inspect dependencies for october/backend

How to Check if You Are Affected

To determine whether your application is affected by CVE-2021-21265, inspect your project dependencies for October/backend:

inspect dependencies for october/backend

Analyze the terminal output to locate any version of October/backend in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.1.2), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-644: Improper Neutralization of HTTP Headers for Scripting Syntax, where the product does not neutralize or incorrectly neutralizes web scripting syntax in http headers that can be used by web browser components that can process raw headers, such as flash. In October/backend, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact When running on servers that are configured to accept a wildcard as a hostname (i.e. the server routes any request, regardless of the HOST header to an October CMS instance) the potential exists for Host Header Poisoning attacks to succeed. See the following resources for more information on Host Header Poisoning: - https://portswigger.net/web-security/host-header - https://dzone.com/articles/what-is-a-host-header-attack ### Patches A feature has been added in v1.1.2 to allow a set of trusted hosts to be specified in the application. ### Workarounds - Apply https://github.com/octobercms/library/commit/f86fcbcd066d6f8b939e8fe897409d152b11c3c6 & https://github.com/octobercms/october/commit/f638d3f78cfe91d7f6658820f9d5e424306a3db0 to your installation manually if unable to upgrade to v1.1.2. - Check that the configuration setting `cms.linkPolicy` is set to `force`. ### Alternative Workaround Check to make sure that your web server does not accept any hostname when serving your web application. 1. Add an entry called `testing.tld` to your computer's host file and direct it to your server's IP address 2. Open the address `testing.tld` in your web browser 3. Make sure an October CMS website is not available at this address If an October CMS website is returned, configure your webserver to only allow known hostnames. If you require assistance with this, please contact your server administrator. ### References Reported by [Abdullah Hussam](https://github.com/ahussam) ### For More Information If you have any questions or comments about this advisory: * Email us at [hello@octobercms.com](mailto:hello@octobercms.com) ### Threat Assessment <img width="1108" alt="Screen Shot 2021-01-15 at 4 12 57 PM" src="https://user-images.githubusercontent.com/7253840/104783859-92fb3600-574c-11eb-9e21-c0dc05d230a9.png">

CVE-2021-21265 Affected October/backend Versions

1 component(s)

Fixed Versions:

1.1.2

Product / Package	Ecosystem	Affected Versions	Fixed Version
october/backend	Packagist	< 1.1.2	1.1.2

References

GitHub Advisory / Wiki ADVISORY

https://github.com/octobercms/october/security/advisories/GHSA-xhfx-hgmf-v6vp

NVD — CVE-2021-21265 NVD

https://nvd.nist.gov/vuln/detail/CVE-2021-21265

Security Fix Commit FIX COMMIT

https://github.com/octobercms/library/commit/f29865ae3db7a03be7c49294cd93980ec457f10d

Security Fix Commit FIX COMMIT

https://github.com/octobercms/library/commit/f86fcbcd066d6f8b939e8fe897409d152b11c3c6

Security Fix Commit FIX COMMIT

https://github.com/octobercms/october/commit/555ab61f2313f45d7d5d138656420ead536c5d30

Security Fix Commit FIX COMMIT

https://github.com/octobercms/october/commit/f638d3f78cfe91d7f6658820f9d5e424306a3db0

packagist.org/packages/october/ba... WEB

https://packagist.org/packages/october/backend

Frequently Asked Questions

What is CVE-2021-21265?

CVE-2021-21265 is a security vulnerability in October/backend involving October CMS vulnerable to Potential Host Header Poisoning on misconfigured servers under CWE-644: Improper Neutralization of HTTP Headers for Scripting Syntax.

Which October/backend versions are affected?

Affected versions include releases prior to 1.1.2 across affected packages: october/backend.

What version fixes CVE-2021-21265?

Upgrading to 1.1.2 (or the latest patched release for your respective branch) resolves the vulnerability.

Is october/backend affected?

Yes, october/backend is affected in releases prior to 1.1.2. Upgrade your dependency to 1.1.2 or later.

What CWE is associated with CVE-2021-21265?

CVE-2021-21265 is classified under CWE-644: Improper Neutralization of HTTP Headers for Scripting Syntax (The product does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash.).

How can I check Packagist dependencies for CVE-2021-21265?

Run the dependency tree command: 'inspect dependencies for october/backend'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-xhfx-hgmf-v6vp",
  "modified" : "2025-05-29T23:26:01Z",
  "published" : "2021-03-10T21:07:25Z",
  "aliases" : [ "CVE-2021-21265" ],
  "summary" : "October CMS vulnerable to Potential Host Header Poisoning on misconfigured servers",
  "details" : "### Impact\nWhen running on servers that are configured to accept a wildcard as a hostname (i.e. the server routes any request, regardless of the HOST header to an October CMS instance) the potential exists for Host Header Poisoning attacks to succeed. See the following resources for more information on Host Header Poisoning:\n- https://portswigger.net/web-security/host-header\n- https://dzone.com/articles/what-is-a-host-header-attack\n\n### Patches\n\nA feature has been added in v1.1.2 to allow a set of trusted hosts to be specified in the application.\n\n### Workarounds\n\n- Apply https://github.com/octobercms/library/commit/f86fcbcd066d6f8b939e8fe897409d152b11c3c6 & https://github.com/octobercms/october/commit/f638d3f78cfe91d7f6658820f9d5e424306a3db0 to your installation manually if unable to upgrade to v1.1.2.\n\n- Check that the configuration setting `cms.linkPolicy` is set to `force`.\n\n### Alternative Workaround\n\nCheck to make sure that your web server does not accept any hostname when serving your web application.\n\n1. Add an entry called `testing.tld` to your computer's host file and direct it to your server's IP address\n2. Open the address `testing.tld` in your web browser\n3. Make sure an October CMS website is not available at this address\n\nIf an October CMS website is returned, configure your webserver to only allow known hostnames. If you require assistance with this, please contact your server administrator.\n\n### References\n\nReported by [Abdullah Hussam](https://github.com/ahussam)\n\n### For More Information\n\nIf you have any questions or comments about this advisory:\n* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)\n\n### Threat Assessment\n<img width=\"1108\" alt=\"Screen Shot 2021-01-15 at 4 12 57 PM\" src=\"https://user-images.githubusercontent.com/7253840/104783859-92fb3600-574c-11eb-9e21-c0dc05d230a9.png\">",
  "severity" : [ ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "october/backend"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.1.2"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/octobercms/october/security/advisories/GHSA-xhfx-hgmf-v6vp"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2021-21265"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/octobercms/library/commit/f29865ae3db7a03be7c49294cd93980ec457f10d"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/octobercms/library/commit/f86fcbcd066d6f8b939e8fe897409d152b11c3c6"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/octobercms/october/commit/555ab61f2313f45d7d5d138656420ead536c5d30"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/octobercms/october/commit/f638d3f78cfe91d7f6658820f9d5e424306a3db0"
  }, {
    "type" : "WEB",
    "url" : "https://packagist.org/packages/october/backend"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-644" ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2021-03-10T21:07:08Z",
    "nvd_published_at" : "2021-03-10T22:15:00Z"
  }
}

Advisory Metadata

Source ID: GHSA-xhfx-hgmf-v6vp
Schema Version: 1.4.0
Published: 2021-03-10 21:07
Last Modified: 2025-05-29 23:26
Database Record File: advisories/github-reviewed/2021/03/GHSA-xhfx-hgmf-v6vp/GHSA-xhfx-hgmf-v6vp.json