Summary

The server uses the Origin value from the request headers as the email link baseUrl without validation. If an attacker controls the Origin, password reset / email verification links in emails can be generated pointing to the attacker’s domain, causing authentication tokens to be exposed and potentially leading to account takeover.

Details

The core of the vulnerability is that two endpoints use the request Origin header as the baseUrl without validation.

Vulnerable code

1. /forgotPassword

   https://github.com/appsmithorg/appsmith/blob/release/app/server/appsmith-server/src/main/java/com/appsmith/server/controllers/ce/UserControllerCE.java#L90-L100

   @PostMapping("/forgotPassword")
   public Mono<ResponseDTO<Boolean>> forgotPasswordRequest(
           @RequestBody ResetUserPasswordDTO userPasswordDTO, @RequestHeader("Origin") String originHeader) {
       userPasswordDTO.setBaseUrl(originHeader);
       return service.forgotPasswordTokenGenerate(userPasswordDTO)
               .defaultIfEmpty(true)
               .onErrorReturn(true)
               .thenReturn(new ResponseDTO<>(HttpStatus.OK, true));
   }

   The /forgotPassword API uses the Origin value provided by the client as the email link baseUrl without validation.

2. /resendEmailVerification

   https://github.com/appsmithorg/appsmith/blob/release/app/server/appsmith-server/src/main/java/com/appsmith/server/controllers/ce/UserControllerCE.java#L189-L196

   @PostMapping("/resendEmailVerification")
   public Mono<ResponseDTO<Boolean>> resendEmailVerification(
           @RequestBody ResendEmailVerificationDTO resendEmailVerificationDTO,
           @RequestHeader("Origin") String originHeader) {
       resendEmailVerificationDTO.setBaseUrl(originHeader);
       return service.resendEmailVerification(resendEmailVerificationDTO, null)
               .thenReturn(new ResponseDTO<>(HttpStatus.OK, true));
   }

   In the same way, it uses ResendEmailVerificationDTO.setBaseUrl(originHeader) to include the Origin value when generating the link.

PoC

If an attacker sets the Origin to their own domain and sends a password reset request, the link generated in the email will point to the attacker’s domain, potentially exposing the token.

Reproduction Steps

1. The attacker sends a password reset request for the victim’s email. The request header’s Origin value is set to the attacker’s domain (e.g., https://36fab03272ba.ngrok-free.app).
2. The server uses the received Origin as the baseUrl to generate the link included in the email. Example: https://36fab03272ba.ngrok-free.app/user/resetPassword?token=...
3. When the victim clicks the link in the email, the request is sent to the attacker’s domain, and the token is exposed.
4. The attacker uses the leaked token to reset the password and gain access to the account.

Impact

• Account Takeover: If an attacker obtains the token from the email link, they can log in to the victim’s account or change the password.
• Personal Information Exposure: User email addresses and account-related information may be exposed to third parties.
• Phishing / Malicious Redirection: Legitimate emails can be used to lure users to an attacker-controlled site, enabling further malicious actions (e.g., credential theft).
• Service Trust and Compliance Risks: If email links point to external domains, user trust may decrease, and legal or compliance issues may arise.