CVE-2025-25198: Mailcow Auth Bypass Vulnerability

CVE-2025-25198 Overview

CVE-2025-25198 is a Host Header Injection vulnerability affecting mailcow: dockerized, an open source groupware/email suite based on Docker. The vulnerability exists in mailcow's password reset functionality, allowing an attacker to manipulate the Host HTTP header to generate a password reset link pointing to an attacker-controlled domain. This can lead to complete account takeover if a user clicks the poisoned link.

Critical Impact

Attackers can hijack user accounts by intercepting password reset tokens through Host header manipulation, potentially compromising all mailbox data, email communications, and associated services.

Affected Products

• mailcow: dockerized versions prior to 2025-01a
• All installations with password reset functionality enabled

Discovery Timeline

• 2025-02-12 - CVE-2025-25198 published to NVD
• 2025-10-01 - Last updated in NVD database

Technical Details for CVE-2025-25198

Vulnerability Analysis

This vulnerability is classified as CWE-601 (URL Redirection to Untrusted Site / Open Redirect). The flaw resides in how the mailcow application constructs password reset URLs. When a user requests a password reset, the application uses the Host HTTP header value to build the reset link URL that gets sent to the user's email address.

Because the application trusts the client-supplied Host header without proper validation, an attacker can inject their own domain into this header. When the victim receives the password reset email and clicks the link, they are directed to the attacker's server instead of the legitimate mailcow instance. The attacker's server then captures the password reset token, allowing them to reset the victim's password and take over the account.

This attack requires user interaction—the victim must click the malicious link in the password reset email. However, since the email appears to come from the legitimate mailcow server and users typically trust password reset emails, the attack has a high likelihood of success.

Root Cause

The root cause is improper validation of the Host HTTP header when generating password reset URLs. The application directly incorporates the user-controllable Host header value into the password reset link without validating it against a whitelist of allowed domains. This violates the security principle of never trusting client-supplied input for security-critical operations.

Attack Vector

The attack follows this sequence:

1. The attacker identifies a target mailcow user's email address
2. The attacker initiates a password reset request for the victim's account while intercepting the request
3. The attacker modifies the Host header in the HTTP request to point to their malicious domain
4. The mailcow server generates a password reset link using the attacker-controlled domain
5. The victim receives an email with the poisoned reset link
6. When the victim clicks the link, they are redirected to the attacker's server
7. The attacker captures the password reset token from the URL
8. The attacker uses the token on the legitimate mailcow server to reset the victim's password

The attack exploits the trust relationship between users and password reset emails, combined with the server's improper handling of the Host header. For detailed technical information, refer to the GitHub Security Advisory.

Detection Methods for CVE-2025-25198

Indicators of Compromise

• Password reset requests with unusual or external domain values in the Host header
• Web server logs showing password reset endpoint access with mismatched Host headers
• User reports of receiving password reset emails they did not request
• Multiple failed login attempts following password reset requests from different IP addresses
• DNS queries or connections to unknown external domains from the mailcow server

Detection Strategies

• Monitor HTTP request logs for password reset endpoints with Host headers that don't match your legitimate domain
• Implement alerting on password reset requests where the Host header differs from the expected server hostname
• Review email server logs for password reset emails being sent without corresponding legitimate user requests
• Deploy web application firewalls (WAF) with rules to detect Host header manipulation attacks

Monitoring Recommendations

• Enable detailed logging on the mailcow web interface, particularly for authentication and password reset functions
• Configure SIEM rules to correlate password reset requests with subsequent account access from new IP addresses or locations
• Monitor for account lockouts or password changes that follow shortly after password reset emails
• Implement anomaly detection for unusual patterns in password reset request volumes

How to Mitigate CVE-2025-25198

Immediate Actions Required

• Upgrade mailcow: dockerized to version 2025-01a or later immediately
• Review recent password reset requests in logs for signs of exploitation
• Notify users to be cautious of password reset emails and verify the domain before clicking links
• Consider forcing password resets for accounts that may have been compromised

Patch Information

The vulnerability has been addressed in mailcow: dockerized version 2025-01a. The patch implements proper validation of the Host header to ensure password reset links always point to the legitimate server domain. Administrators should upgrade to this version or later by pulling the latest Docker images and following the standard mailcow update procedure. For complete patch details, see the GitHub Security Advisory.

Workarounds

• Deactivate password reset functionality by clearing the Notification email sender and Notification email subject fields under System → Configuration → Options → Password Settings
• Implement a reverse proxy with strict Host header validation that rejects requests with unexpected Host values
• Configure firewall rules to limit access to the mailcow admin interface to trusted IP ranges
• Manually handle password resets through the admin panel instead of self-service reset until patching is complete