Poweradmin is a web-based DNS administration tool for PowerDNS server. Versions prior to 4.2.4 and 4.3.3 use the attacker-controlled `HTTP_HOST` request header as the authoritative source for building callback URLs in its OIDC, SAML, and logout authentication flows without any validation. An unauthenticated attacker can poison the `redirect_uri` sent to the Identity Provider, causing the IdP to redirect the victim's authorization code to an attacker-controlled server - resulting in full account takeover with no credentials required. Versions 4.2.4 and 4.3.3 patch the issue.
An attacker manipulates the `HTTP_HOST` header in an HTTP request by injecting their own domain as part of the `redirect_uri` address sent to the identity provider (IdP). The identity provider, without verifying the origin of the callback address, redirects the victim's authorization code to a server controlled by the attacker. The intercepted authorization code allows the attacker to authenticate as the victim and take over their account without needing to provide a password.
An attacker can take full control of any user account using OIDC or SAML flows, including administrative accounts, giving them unlimited access to PowerDNS-based DNS infrastructure management.
Poweradmin should be updated to version 4.2.4 or 4.3.3, which eliminate the vulnerability by validating the `HTTP_HOST` header. Patches are available in the vendor's GitHub repository.
Poweradmin versions prior to 4.2.4 (4.2.x branch) and prior to 4.3.3 (4.3.x branch) when OIDC or SAML authentication is used.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L