Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.93, the server uses the Origin value from the request headers as the email link baseUrl without validation. If an attacker controls the Origin, password reset / email verification links in emails can be generated pointing to the attacker’s domain, causing authentication tokens to be exposed and potentially leading to account takeover. This vulnerability is fixed in 1.93.
The vulnerability results from a lack of validation of the Origin header value (CWE-346 — Origin Validation Error) when generating links sent via email. An attacker initiates a password reset or email verification request for a target account, substituting an attacker-controlled domain address in the Origin header. The Appsmith server, without verifying the trustworthiness of this value, embeds it as the base URL in the email message sent to the victim. When the victim clicks on such a link, the authentication token contained in the URL is sent to the attacker's server.
An attacker can intercept a password reset or email verification token and use it to take full control of the victim's account in Appsmith.
Update Appsmith to version 1.93 or later, in which the issue has been fixed (commit 6f9ee6226bac13fb4b836940b557913fff78b633). If immediate update is not possible, restrict access to password reset and email verification functions at the network level.
Appsmith in all versions before 1.93.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HAppsmith
APPAppsmith< 1.93
Related vulnerabilities
Appsmith: SSRF umożliwia przejęcie konfiguracji reverse proxy Caddy
Stored XSS w Appsmith Table Widget prowadzący do przejęcia konta admina
Appsmith: nieuwierzytelniony dostęp do akcji trybu edycji (brak autoryzacji)
Appsmith: RCE przez błędnie skonfigurowany PostgreSQL w kontenerze Docker
Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, Appsmith's bundled...