CVE-2025-27913
Published: 10 March 2025
Summary
CVE-2025-27913 is a high-severity Use of Less Trusted Source (CWE-348) vulnerability in Passbolt Passbolt Api. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Validates HTTP Host header inputs to prevent attacker-controlled domains from being incorporated into email messages.
Enforces secure configuration settings during installation to avoid trusting unvalidated Host headers and ensure health check compliance.
Remediates the specific flaw by applying patches or upgrades to Passbolt API version 5 or later.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a host header injection flaw in a public-facing Passbolt API that enables remote unauthenticated attackers to manipulate email domains sent by the server, directly facilitating email spoofing (T1672) via exploitation of a public-facing application (T1190).
NVD Description
Passbolt API before 5, if the server is misconfigured (with an incorrect installation process and disregarding of Health Check results), can send email messages with a domain name taken from an attacker-controlled HTTP Host header.
Deeper analysisAI
CVE-2025-27913 affects the Passbolt API in versions before 5. The vulnerability arises when the server is misconfigured through an incorrect installation process and disregard of Health Check results, enabling the API to send email messages that incorporate a domain name sourced from an attacker-controlled HTTP Host header. This constitutes a Host Header Injection issue, mapped to CWE-348, with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
Remote attackers require no privileges or user interaction to exploit this vulnerability over the network with low complexity. By crafting HTTP requests with a manipulated Host header, they can influence the domain used in emails sent by the Passbolt server, achieving high integrity impact through potential email spoofing.
The official advisory from Passbolt, available at https://www.passbolt.com/incidents/host-header-injection, provides details on mitigation steps for this issue.
Details
- CWE(s)