GHSA-j9gf-vw2f-9hrw: Appsmith: Configuration-dependent origin validation bypass in password reset and email verification link generation
SummaryA configuration-dependent origin validation bypass was identified in Appsmith’s password reset and email verification flows on current `release`.Both flows derive the email-link base URL from the request `Origin` header. The current validation only enforces a trusted base URL when `APPSMITH_BASE_URL` is configured. If that setting is unset, the application accepts the caller-supplied origin and uses it to generate token-bearing reset and verification links.On deployments with email delivery enabled and `APPSMITH_BASE_URL` unset, this can cause Appsmith to send security-sensitive links whose clickable host is attacker-controlled, which can plausibly lead to account takeover after victim interaction.DetailsThe current `release` head at commit `e77639eca4974469c1e676904851ffdaedd38111` was reviewed.The relevant routes are publicly reachable in `SecurityConfig.java`:`POST /forgotPassword` is permitted without authentication at line `209``POST /resendEmailVerification` is permitted without authentication at line `228`In `UserControllerCE.java`, both flows copy the request `Origin` header into the DTO field used as the email-link base URL:`forgotPasswordRequest(...)` at lines `91-94``resendEmailVerification(...)` at lines `189-193`In `UserServiceCEImpl.java`, base URL validation is conditional:`@Value("${APPSMITH_BASE_URL:}")` at line `113``resolveSecureBaseUrl(...)` at lines `132-145`That method explicitly documents and implements this behavior:if `APPSMITH_BASE_URL` is configured, the provided URL must match itif `APPSMITH_BASE_URL` is unset, the provided URL is accepted for backward compatibilityThe resulting base URL is then used to construct token-bearing links:`FORGOT_PASSWORD_CLIENT_URL_FORMAT` at line `149`reset URL generation at lines `282-289``EMAIL_VERIFICATION_CLIENT_URL_FORMAT` at line `152`verification URL generation at lines `931-940`This means the base URL is not only used for branding or display purposes. It directly controls the clickable host of security-sensitive reset and verification links.Note that the admin UI describes APPSMITH_BASE_URL as required for password reset and email verification links in:`app/client/src/ce/pages/AdminSettings/config/configuration.tsx` at lines `41-49`The reviewed self-host material indicates this protection is not fail-closed by default, which makes the vulnerable condition realistic on existing deployments where operators have not set `APPSMITH_BASE_URL`.PoCThese steps were designed for validation on an Appsmith deployment that I own or am explicitly authorized to test.Deploy a non-production Appsmith instance from current `release`, or any build containing the affected code.Enable outbound email delivery.Leave `APPSMITH_BASE_URL` unset or blank.Use a test mailbox account you control, for example `victim@example.test`.Send a password reset request with a forged `Origin` header:Inspect the delivered email. If affected, the clickable reset link is generated under `https://attacker.example/...` instead of the legitimate Appsmith host.Repeat the same validation for resend email verification using an unverified test account:Inspect the delivered verification email. If affected, the clickable verification link is generated under `https://attacker.example/....`Set `APPSMITH_BASE_URL=https://YOUR-INSTANCE`, restart the server, and repeat the same requests.The expected secure behavior is that mismatched `Origin`  is rejected, or the generated links no longer follow the forged request header.Live tokens, third-party data, or unsafe exploitation material was not included in this report. The attached archive contains source excerpts, data-flow proof, safe validation notes, and supporting evidence collected from the reviewed current branch.ImpactThis is a trust-boundary failure in token-bearing email authentication flows.Affected deployments are those where:`APPSMITH_BASE_URL` is unset or blankoutbound email is enabledpassword reset and/or email verification flows are enabledAttacker requirements are low:no prior authentication is required to reach the relevant endpointsthe attacker only needs to trigger an email flow toward a target accountSecurity impact:Appsmith can generate password reset or verification emails whose clickable host is attacker-controlledvictim interaction can expose security-sensitive token materialthis can plausibly result in account takeoverat minimum, it enables trusted-email abuse and phishing through the application itselfmitigationRemove the fallback behavior in `resolveSecureBaseUrl(...)` that accepts caller-supplied origin data when `APPSMITH_BASE_URL` is unset.Fail closed for all token-bearing email flows when no trusted base URL is configured.Use a single trusted-base-url helper across:password resetresend email verificationinvite flowsinstance admin invite flowsAdd regression tests for the unset-configuration case.Add startup or admin-level validation so security-sensitive email flows cannot operate until a trusted base URL is configured.Attachment[appsmith-email-link-origin-validation-bypass-20260321.zip](https://github.com/user-attachments/files/26153718/appsmith-email-link-origin-validation-bypass-20260321.zip)
CVSS v3.1: 8.1