CVE-2021-38290: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
value: A host header attack vulnerability exists in FUEL CMS 1.5.0 through fuel/modules/fuel/config/fuel_constants.php and fuel/modules/fuel/libraries/Asset.php. An attacker can use a man in the middle attack such as phishing.
CWE description: The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CVSS v3 base score: 8.1
Published: 2021-08-09T11:15Z
Repository: https://github.com/daylightstudio/FUEL-CMS
Language: PHP
Files changed: fuel/modules/fuel/config/fuel_constants.php, fuel/modules/fuel/libraries/Asset.php, index.php
Commit date: 2021-08-06 11:21:48 -0700
Commit message: fix: issue #580 using $_SERVER[‘HTTP_HOST’]

Diff: diff --git a/fuel/modules/fuel/config/fuel_constants.php b/fuel/modules/fuel/config/fuel_constants.php
index 50f78f909..3f8192ab8 100644
--- a/fuel/modules/fuel/config/fuel_constants.php
+++ b/fuel/modules/fuel/config/fuel_constants.php
@@ -68,11 +68,11 @@ foreach ($config['modules_allowed'] as $module)
 	}
 }
 
 if ( ! defined('BASE_URL'))
 {
-	$_base_path = $_SERVER['HTTP_HOST'].str_replace(basename($_SERVER['SCRIPT_NAME']),"",$_SERVER['SCRIPT_NAME']);
+	$_base_path = $_SERVER['SERVER_NAME'].str_replace(basename($_SERVER['SCRIPT_NAME']),"",$_SERVER['SCRIPT_NAME']);
 
 	if ( ! empty($_SERVER['HTTPS']) && strtolower($_SERVER['HTTPS']) !== 'off' OR $_SERVER['SERVER_PORT'] == 443)
 	{
 		define('BASE_URL', "https://".$_base_path);
 	}
diff --git a/fuel/modules/fuel/libraries/Asset.php b/fuel/modules/fuel/libraries/Asset.php
index 1f0da1866..30417a266 100644
--- a/fuel/modules/fuel/libraries/Asset.php
+++ b/fuel/modules/fuel/libraries/Asset.php
@@ -499,11 +499,11 @@ class Asset {
 		$path = WEB_PATH.$assets_path.$asset_type.$file.$cache;
 
 		if ($absolute)
 		{
 			$protocol = ($_SERVER["SERVER_PORT"] == 443) ? "https://" : "http://";
-			$path = $protocol.$_SERVER['HTTP_HOST'].$path;
+			$path = $protocol.$_SERVER['SERVER_NAME'].$path;
 		}
 		return $path;
 	}
 
 	// --------------------------------------------------------------------
diff --git a/index.php b/index.php
index b61216b8a..902786625 100755
--- a/index.php
+++ b/index.php
@@ -108,11 +108,11 @@ else
 			{
 				// Convert wild-cards to RegEx
 				$path = str_replace(array(':any', '*'), '.*', str_replace(':num', '[0-9]+', $path));
 
 				// Does the RegEx match?
-				if (!empty($_SERVER['HTTP_HOST']) AND preg_match('#^'.$path.'$#', $_SERVER['HTTP_HOST']))
+				if (!empty($_SERVER['SERVER_NAME']) AND preg_match('#^'.$path.'$#', $_SERVER['SERVER_NAME']))
 				{
 					define('ENVIRONMENT', $env);
 					break 2;
 				}
 			}

Vulnerable code: 	$_base_path = $_SERVER['HTTP_HOST'].str_replace(basename($_SERVER['SCRIPT_NAME']),"",$_SERVER['SCRIPT_NAME']);
			$path = $protocol.$_SERVER['HTTP_HOST'].$path;
				if (!empty($_SERVER['HTTP_HOST']) AND preg_match('#^'.$path.'$#', $_SERVER['HTTP_HOST']))
Fixed code: 	$_base_path = $_SERVER['SERVER_NAME'].str_replace(basename($_SERVER['SCRIPT_NAME']),"",$_SERVER['SCRIPT_NAME']);
			$path = $protocol.$_SERVER['SERVER_NAME'].$path;
				if (!empty($_SERVER['SERVER_NAME']) AND preg_match('#^'.$path.'$#', $_SERVER['SERVER_NAME']))