Status: Patched
This vulnerability has been verified as resolved and deployed.
Administrator password-reset link poisoning enables account takeover
Summary
The password-reset email derived its absolute authority from the anonymous request Host header
An unauthenticated attacker could request an administrator password reset with an attacker-controlled Host header. The legitimate email then contained the real reset token under the attacker's HTTPS origin, allowing token capture when the administrator clicked it.
Root cause. Reset token generation and email rendering happened synchronously inside the initiating request. Twig's absolute url() helper used the request-derived router context, while the application supplied neither a strict trusted-host policy nor a canonical security-link origin.
Remediation evidence. Sylius confirmed the report, published GHSA-77w3-2367-7xvq with an explicit Winfunc Research credit, and released fixes in 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9.
CVSS Score
Vulnerability Location
Source-to-Sink Analysis
The public reset operation accepts the victim administrator email while the request carries attacker-selected authority metadata.
The handler generates a fresh token and dispatches the email command within the same poisoned request context.
The absolute URL helper embeds the attacker-controlled authority together with the valid secret token.
Impact Analysis
Critical Impact
The attacker can replace the administrator's password and exercise that account's administrative privileges. Downstream access to customer data, orders, configuration, and user management depends on the victim administrator's assigned roles.
Attack Surface
The unauthenticated Sylius administrator password-reset API on deployments that accepted arbitrary Host headers.
Preconditions
The attacker knows the administrator's email and controls an HTTPS origin. The victim must click the legitimate reset email; no mailbox access, existing session, or Sylius credential is required.
Proof of Concept
Environment Setup
Use an isolated affected Sylius instance, a test administrator mailbox, and an attacker-controlled local HTTPS origin.
Target Configuration
Route a request with an arbitrary Host value to Sylius without an upstream host allowlist, matching the vulnerable deployment condition.
Exploit Delivery
Send the public reset request with Host: attacker.example, then follow the received email and record the token-bearing request made to the attacker origin.
Outcome
Patched releases construct the security link from trusted canonical configuration, so request authority cannot redirect a valid reset token to another host.
Expected Response: The email link points to the attacker host and contains a valid administrator reset token that the real reset endpoint accepts.
Run this level of analysis on your repo.
Winfunc traces source-to-sink paths, validates exploitability, and gives your team patch-ready remediation.