CVE-2023-24044

Deeper analysis

CVE-2023-24044 is a host header injection vulnerability affecting the login page of Plesk Obsidian versions through 18.0.49. The flaw permits an attacker to supply an arbitrary value in the Host request header, which the application reflects without validation and thereby enables an open redirect. The issue is tracked under CWE-601 and carries a CVSS 3.1 base score of 6.1.

An unauthenticated remote attacker can exploit the weakness by crafting a request to the login endpoint that contains a malicious Host header. When a victim follows the resulting URL, the browser is redirected to an attacker-controlled site, allowing phishing or further client-side attacks. User interaction is required, but no privileges are needed on the Plesk instance.

Plesk has stated that the ability to reach the panel via arbitrary domain names is an intended feature and has not issued a corrective patch. Public references, including a Plesk support article and technical write-ups, document the behavior but do not describe additional mitigations. The associated EPSS score has remained near 0.59 since disclosure, indicating sustained but not sharply increasing exploitation interest.