CVE-2023-24044: Plesk Obsidian Host Header Injection Flaw

CVE-2023-24044 Overview

CVE-2023-24044 is a Host Header Injection vulnerability affecting the Login page of Plesk Obsidian through version 18.0.49. This flaw allows attackers to redirect users to malicious websites by manipulating the Host request header. The vulnerability is classified as an Open Redirect (CWE-601), which can be leveraged for phishing attacks and credential theft.

It is important to note that the vendor's official position is that "the ability to use arbitrary domain names to access the panel is an intended feature." This disputed status means organizations must carefully evaluate their own risk exposure and implement compensating controls.

Critical Impact

Attackers can craft malicious links that appear to originate from legitimate Plesk login pages, potentially leading users to phishing sites designed to steal credentials or distribute malware.

Affected Products

• Plesk Obsidian through version 18.0.49

Discovery Timeline

• 2023-01-22 - CVE-2023-24044 published to NVD
• 2025-04-02 - Last updated in NVD database

Technical Details for CVE-2023-24044

Vulnerability Analysis

This Host Header Injection vulnerability exists in the Login page of Plesk Obsidian. The web application fails to properly validate or sanitize the Host header in HTTP requests, allowing attackers to inject arbitrary domain names. When a user interacts with the manipulated page, they may be redirected to an attacker-controlled website.

The vulnerability requires user interaction to exploit, as the victim must click on a crafted link or be redirected through the vulnerable endpoint. Once triggered, the scope changes as the attack can affect resources beyond the vulnerable application itself, potentially impacting user confidentiality and integrity through credential theft or malware distribution.

Root Cause

The root cause of this vulnerability lies in improper validation of the HTTP Host header on the Plesk Obsidian Login page. The application trusts the Host header value supplied by the client without sufficient validation, allowing attackers to control where users are redirected. This is a classic example of CWE-601 (URL Redirection to Untrusted Site), where external input is used to construct redirect URLs without proper sanitization.

Attack Vector

The attack is network-based and requires low complexity to execute. An attacker can exploit this vulnerability by crafting a malicious URL that includes a manipulated Host header. When an unsuspecting user clicks on this link, typically delivered via phishing emails or compromised websites, they are redirected to the attacker's domain.

The attack flow typically involves:

1. The attacker identifies a Plesk Obsidian installation vulnerable to Host Header Injection
2. A malicious link is crafted with a spoofed Host header pointing to an attacker-controlled domain
3. The victim receives the link through phishing or social engineering
4. Upon clicking, the victim is redirected to the malicious site, which may mimic the legitimate Plesk login page
5. Credentials entered on the fake page are captured by the attacker

For technical details and proof-of-concept information, researchers have documented this vulnerability in the GitHub Gist PoC and the Medium CVE Analysis.

Detection Methods for CVE-2023-24044

Indicators of Compromise

• Unusual HTTP requests to Plesk login pages containing unexpected or suspicious Host header values
• Web server logs showing requests with Host headers pointing to external or unfamiliar domains
• Reports from users about being redirected to unexpected websites after clicking Plesk-related links
• Phishing emails containing links to legitimate Plesk installations with manipulated parameters

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests with mismatched or suspicious Host headers
• Monitor HTTP request logs for anomalous Host header values that don't match your legitimate domain names
• Deploy network intrusion detection systems (NIDS) with signatures for Host Header Injection patterns
• Use endpoint detection and response (EDR) solutions to identify users being redirected to known malicious domains

Monitoring Recommendations

• Regularly review web server access logs for requests with unexpected Host header values
• Configure alerting for HTTP traffic patterns consistent with Host Header Injection attempts
• Monitor for newly registered domains that closely resemble your Plesk installation URLs (typosquatting)
• Implement user reporting mechanisms for suspicious login page behavior

How to Mitigate CVE-2023-24044

Immediate Actions Required

• Review the Plesk Security Advisory for vendor guidance
• Implement Host header validation at the web server or reverse proxy level
• Configure web application firewall rules to restrict accepted Host header values
• Educate users about verifying URLs before entering credentials on Plesk login pages

Patch Information

The vendor (Plesk) has disputed this CVE, stating that the ability to use arbitrary domain names to access the panel is an intended feature. Organizations should consult the Plesk Security Advisory for the latest guidance and evaluate whether this behavior aligns with their security requirements.

Workarounds

• Configure your web server (Apache/Nginx) to only respond to requests with valid, expected Host headers
• Implement a reverse proxy that validates and normalizes Host headers before forwarding requests to Plesk
• Restrict access to the Plesk login page to trusted IP ranges or VPN connections
• Deploy multi-factor authentication (MFA) to reduce the impact of potential credential theft

# Nginx configuration to restrict Host headers
# Add to your server block configuration
server {
    listen 443 ssl;
    server_name your-plesk-domain.com;
    
    # Reject requests with unexpected Host headers
    if ($host !~ ^(your-plesk-domain\.com)$ ) {
        return 444;
    }
    
    # Rest of your configuration...
}