Attack Chain

1. Attacker identifies a target administrator's email address associated with the Sylius instance.
2. Attacker initiates a password reset request via the legitimate application endpoint (e.g., /password-reset/request).
3. Attacker intercepts the outgoing HTTP request using a proxy or intercepting tool.
4. Attacker modifies the 'Host' header field in the request to point to an attacker-controlled domain.
5. The Sylius backend processes the request and uses the malicious 'Host' header to generate the URL for the password reset token.
6. The application sends the password reset email to the legitimate administrator, containing the poisoned, attacker-controlled link.
7. The administrator clicks the malicious link, sending the reset token to the attacker's infrastructure.
8. Attacker utilizes the intercepted token to reset the administrator's password and gain unauthorized administrative access.

Impact

Successful exploitation allows unauthenticated attackers to perform full account takeover of administrative accounts. This grants attackers unauthorized access to the Sylius management dashboard, allowing for data exfiltration, system configuration changes, and further persistence within the application environment.

Recommendation

Prioritize patching affected Sylius installations to the latest secure versions. For environments unable to patch immediately, implement strict validation of the 'Host' header at the web application firewall (WAF) or load balancer level to ensure only authorized hostnames are accepted for administrative requests.