UnoPim versions before 2.0.1 and 2.1.1 trust all connecting clients as proxies and honor the X-Forwarded-Host header without validation, allowing unauthenticated attackers to inject arbitrary origins into admin layout pages. Attackers can set X-Forwarded-Host to redirect JavaScript asset loading to their server, and when responses are cached by shared proxies, subsequent administrators execute attacker-supplied code in their authenticated sessions.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
Present
Additional conditions required
Privileges Required
None
No privileges needed
User Interaction
Passive
Minimal interaction
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
References 7
https://github.com/unopim/unopim
disclosure@vulncheck.com
https://github.com/unopim/unopim/blob/v2.1.0/bootstrap/app.php#L24
disclosure@vulncheck.com
https://github.com/unopim/unopim/blob/v2.1.0/packages/Webkul/Admin/src/Resource…
disclosure@vulncheck.com
https://github.com/unopim/unopim/commit/77e33618df5ba82fc9c9a32d137368e5bbe5ac9c
disclosure@vulncheck.com
https://github.com/unopim/unopim/releases/tag/v2.0.1
disclosure@vulncheck.com
https://github.com/unopim/unopim/releases/tag/v2.1.1
disclosure@vulncheck.com
https://www.vulncheck.com/advisories/unopim-2.0.0-before-2.0.1-and-2.1.0-before…
disclosure@vulncheck.com