CVE-2025-3026: Primekey EJBCA SSRF Vulnerability

CVE-2025-3026 Overview

CVE-2025-3026 is a Host header injection vulnerability affecting PrimeKey EJBCA Enterprise version 8.0. The flaw allows attackers to manipulate the Host header in HTTP requests to influence the base URL used in server-generated links. When a victim interacts with a crafted request, the application produces links pointing to an attacker-controlled server. This enables redirection of subsequent client HTTP traffic to a malicious host under attacker control. The issue is categorized under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). Higher EJBCA versions were not tested by the reporter.

Critical Impact
Attackers can hijack generated links in EJBCA to redirect authenticated or unauthenticated clients toward attacker-controlled infrastructure, enabling phishing and credential capture scenarios.

Affected Products

PrimeKey EJBCA Enterprise 8.0
Deployments exposing the EJBCA web interface to untrusted networks
EJBCA instances behind reverse proxies that forward client-supplied Host headers

Discovery Timeline

2025-03-31 - CVE-2025-3026 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3026

Vulnerability Analysis

The vulnerability exists in how EJBCA Enterprise 8.0 constructs URLs returned to clients. The service trusts the incoming HTTP Host header and uses it to build absolute links embedded in responses. An attacker who can influence the Host header value can cause the server to emit links pointing to a domain of their choosing.

A typical exploitation flow requires user interaction, consistent with the attack characteristics of the CVE record. An attacker crafts a request with a modified Host header and lures a victim to trigger it. The EJBCA response then contains links referencing the attacker-supplied host. Subsequent client actions, such as clicking a password reset or activation link, send traffic to the attacker's server.

Root Cause

The root cause is improper neutralization of the Host header value when generating outbound URLs. EJBCA does not validate the header against an allow-list of expected hostnames or fall back to a configured canonical base URL. This design flaw allows the attacker-controlled input to propagate into rendered HTML and email content.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker sends or induces an HTTP request containing a spoofed Host header to a vulnerable EJBCA instance. The server processes the request and returns responses with links built from the malicious header value. When the victim follows those links, their client connects to the attacker's server rather than the legitimate EJBCA host, exposing session data, credentials, or one-time tokens embedded in URL parameters.

No verified proof-of-concept code is publicly available. See the INCIBE Vulnerability Notice for the coordinated advisory covering this and related EJBCA issues.

Detection Methods for CVE-2025-3026

Indicators of Compromise

HTTP requests to EJBCA endpoints where the Host header does not match the server's configured FQDN or reverse-proxy hostname.
Outbound EJBCA-generated emails or responses containing links with unexpected domains.
Web server access logs showing repeated Host header variations from the same client IP.

Detection Strategies

Compare the Host header of each request against an allow-list of approved EJBCA hostnames and alert on mismatches.
Inspect application logs and generated notification emails for anomalous base URLs in embedded links.
Correlate authentication and enrollment activity with the originating Host header value to identify sessions initiated through spoofed hostnames.

Monitoring Recommendations

Enable verbose HTTP request logging on the EJBCA application server and any fronting reverse proxy.
Forward web access logs and EJBCA audit logs to a central SIEM for retention and correlation.
Establish baseline metrics for expected Host header values and alert on deviations.

How to Mitigate CVE-2025-3026

Immediate Actions Required

Inventory all EJBCA Enterprise deployments and identify instances running version 8.0.
Restrict access to the EJBCA management interfaces to trusted networks and administrative VPNs.
Configure fronting reverse proxies or load balancers to overwrite the Host header with the canonical hostname before forwarding requests to EJBCA.

Patch Information

No vendor patch URL is listed in the current CVE record. Consult PrimeKey and Keyfactor support channels for fixed versions of EJBCA Enterprise, and review the INCIBE Vulnerability Notice for coordinated remediation guidance covering multiple EJBCA vulnerabilities.

Workarounds

Enforce a strict Host header allow-list at the reverse proxy layer and reject requests containing unexpected values.
Configure a fixed canonical base URL in EJBCA and any dependent services so generated links do not rely on the request Host header.
Disable or filter user-triggered features that emit URLs derived from request headers, such as email notifications, until the underlying instance is upgraded.

bash

# Example NGINX reverse proxy configuration enforcing a canonical Host header
server {
    listen 443 ssl;
    server_name ejbca.example.com;

    if ($host != "ejbca.example.com") {
        return 400;
    }

    location / {
        proxy_set_header Host ejbca.example.com;
        proxy_set_header X-Forwarded-Host ejbca.example.com;
        proxy_pass https://ejbca-backend.internal:8443;
    }
}