GHSA-4chg-4752-w88r: NukeViet: Pre-authentication SSRF via X-Forwarded-Host

Summary An unauthenticated attacker can coerce the server into issuing HTTP requests to an attacker-chosen host by spoofing the X Forwarded-Host (and X-Forwarded-Proto) request headers. The forwarded host is used, without validation, to build the URL that server_info_update() fetches with cURL, resulting in a Server-Side Request Forgery (SSRF) that requires no authentication. Affected component - File: includes/ini.php — function server_info_update() (cURL sink) - File: vendor/vinades/nukeviet/Core/Server.php — standardizeHost() and the forwarded-header handling in the constructor (source of the tainted host) - Trigger: POST request containing the field __serverInfoUpdate=1, handled early in includes/ini.php before any authentication. Details NukeViet\Core\Server derives original_host / original_protocol from the X-Forwarded-Host / X-Forwarded-Proto headers and exposes them via getOriginalHost() / getOriginalProtocol(). These values are attacker-controlled and were not validated against the site's configured domains (my_domains). In server_info_update() the tainted host and scheme are concatenated directly into a cURL URL: $proto = $nv_Server->getOriginalProtocol(); // from X-Forwarded-Proto $host = $nv_Server->getOriginalHost(); // from X-Forwarded-Host $ch = curl_init($proto . '://' . $host . NV_BASE_SITEURL . 'index.php?response_headers_detect=1'); curl_exec($ch); Two factors made this reliably reachable: 1. The serverInfoUpdate handler runs very early in includes/ini.php, before authentication, so the sink is reachable pre-auth. 2. The host sanitiser standardizeHost() stripped a trailing port only with the regex (\:[0-9]+)$, which is bypassed by appending a slash (e.g. 127.0.0.1:8081/): the string no longer ends in :digits, so the port survives and an arbitrary host:port reaches the cURL call. Proof of Concept POST /index.php HTTP/1.1 Host: <victim> X-Forwarded-Proto: http X-Forwarded-Host: <attacker-controlled-host>:<port>/ Content-Type: application/