Hack Attack: PKP-WAL Vulnerability Opens Door to LESS Code Injection Mayhem!
The PKP-WAL getBaseUrl() method is vulnerable to unauthenticated attackers via the X-Forwarded-Host header, leading to LESS Code Injection attacks. To exploit this, the allowed_hosts setting must be blank. No official fix yet, but watch out if you like your code injection with a side of chaos!
Hot Take:
Well folks, it looks like the PKP-WAL has found itself in a bit of a pickle, and it’s not the kind you’d want with your sandwich. Unauthenticated attackers can apparently sweet-talk the system with the X-Forwarded-Host HTTP header and get it to serve up a side of LESS code injection. Talk about being a bad host!
Key Points:
- PKP-WAL’s getBaseUrl() method can be manipulated via the X-Forwarded-Host HTTP header.
- This vulnerability allows for LESS code injection, potentially leading to SSRF or Local File Read attacks.
- The vulnerability is exploitable when the allowed_hosts setting is empty in the config.inc.php script.
- No official solution available, but a related GitHub issue might offer a workaround.
- Vulnerability identified as CVE-2025-67891 and discovered by Egidio Romano.
Already a member? Log in here