{"schema":"threatline.record/2","record":{"id":"GHSA-8gcv-3v9h-7gj2","aliases":["GHSA-8gcv-3v9h-7gj2"],"summary":"Host header can redirect production error emails (with request/session data) to an attacker-controlled address","details":"### Impact\nIn production, Wheels sends an email when an unhandled error occurs (`sendEmailOnError` defaults to `true`). If the application doesn't set `errorEmailAddress`, `errorEmailToAddress` or `errorEmailFromAddress`, the framework derives a default address when the application starts. That address is `webmaster@` plus the last two labels of the `Host` header (`cgi.server_name`) of whichever request triggered `onApplicationStart`. The error-email handler then uses it as both recipient and sender. Every release is affected: the derivation dates from 0.9.x.\n\nAn attacker who sends the first request after a cold start (deploy, restart or idle timeout) with a crafted `Host` header, e.g. `Host: x.attacker.tld`, makes every later production error email go to `webmaster@attacker.tld` for the rest of the application's lifetime.\n\nLeaked content: each error email contains the error type and message and the request's URL, method, client IP, host and user agent. The error template also tries to include dumps of the CGI, Form, URL, Application, Session, Request and Cookie scopes, filtered only by `excludeFromErrorEmail`. On Lucee 7 those dumps currently fail to render, so only the header fields are sent. On other engines and versions the scope dumps may be included. Those dumps could expose configuration secrets and other users' session and cookie data.\n\nPreconditions:\n- production environment\n- no explicit error-email recipient configured (the `wheels new` template leaves it commented out)\n- a mail server configured in the CFML engine\n- a server that accepts arbitrary `Host` headers (a default vhost, or a proxy/load balancer that passes `Host` through)\n- the attacker's request is the one that triggers the cold start\n\n### Patches\nFixed in 4.1.2. The framework never derives a mail address from request data, and it sends no error email until a recipient is configured explicitly (it logs a one-time warning instead).\n\n### Workarounds\n- Set `errorEmailToAddress` and `errorEmailFromAddress` (or `errorEmailAddress`) explicitly in `config/production/settings.cfm`, or set `sendEmailOnError=false`.\n- Configure the web server or load balancer to reject requests whose `Host` isn't one of the application's hostnames.","categories":["Unclassified"],"product":"wheels","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/wheels-dev/wheels/security/advisories/GHSA-8gcv-3v9h-7gj2","source_modified_at":"2026-10-11T20:04:40Z","fetched_at":"2026-10-23T20:37:03.234832Z","package":{"ecosystem":"other","name":"wheels"},"range":"<= 4.1.1"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/wheels-dev/wheels/security/advisories/GHSA-8gcv-3v9h-7gj2","source_modified_at":"2026-10-11T20:04:40Z","fetched_at":"2026-10-23T20:37:03.234832Z","package":{"ecosystem":"other","name":"wheels"},"version":"4.1.2"}],"cvss":5.9,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-01T13:04:10Z","modified_at":"2026-10-11T20:04:40Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/wheels-dev/wheels/security/advisories/GHSA-8gcv-3v9h-7gj2","fetched_at":"2026-10-23T20:37:03.234832Z","source_modified_at":"2026-10-11T20:04:40Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-11T20:04:40Z","content_hash":"a8ba4e124bff40c0b94bdb67f8e8c490cbc4798cbbdaf993d2a1d8fe590060c7"}}