wheels: Host header can redirect production error emails (with request/session data) to an attacker-controlled address

Impact

In production, Wheels sends an email when an unhandled error occurs (sendEmailOnError defaults to true). If the application doesn't set errorEmailAddress, errorEmailToAddress or errorEmailFromAddress, the framework derives a default address when the application starts. That address is webmaster@ plus the last two labels of the Host header (cgi.server_name) of whichever request triggered onApplicationStart. The error-email handler then uses it as both recipient and sender. Every release is affected: the derivation dates from 0.9.x.

An attacker who sends the first request after a cold start (deploy, restart or idle timeout) with a crafted Host header, e.g. Host: x.attacker.tld, makes every later production error email go to webmaster@attacker.tld for the rest of the application's lifetime.

Leaked content: each error email contains the error type and message and the request's URL, method, client IP, host and user agent. The error template also tries to include dumps of the CGI, Form, URL, Application, Session, Request and Cookie scopes, filtered only by excludeFromErrorEmail. On Lucee 7 those dumps currently fail to render, so only the header fields are sent. On other engines and versions the scope dumps may be included. Those dumps could expose configuration secrets and other users' session and cookie data.

Preconditions:

• production environment
• no explicit error-email recipient configured (the wheels new template leaves it commented out)
• a mail server configured in the CFML engine
• a server that accepts arbitrary Host headers (a default vhost, or a proxy/load balancer that passes Host through)
• the attacker's request is the one that triggers the cold start

Patches

Fixed in 4.1.2. The framework never derives a mail address from request data, and it sends no error email until a recipient is configured explicitly (it logs a one-time warning instead).

Workarounds

• Set errorEmailToAddress and errorEmailFromAddress (or errorEmailAddress) explicitly in config/production/settings.cfm, or set sendEmailOnError=false.
• Configure the web server or load balancer to reject requests whose Host isn't one of the application's hostnames.