CVE-2025-7777

Description

The mirror-registry doesn't properly sanitize the host header HTTP header in HTTP request received, allowing an attacker to perform malicious redirects to attacker-controlled domains or phishing campaigns.

Statement

The Red Hat Product Security Team has rated this vulnerability as having a Moderate severity. This happens because, although this type of vulnerability usually may lead to important consequences like web-cache poisoning or to access other vhosts that should not be exposed, the mirror-registry is running as a single vhost in a single pod and is not performing request caching thus not being vulnerable to web-cache poisoning. Additionally the usual password reset manipulation/phishing strategy that could be used with the host header injection is not possible here as such requests are handled by RHSSO instead of the mirror-registry itself.

Mitigation

There's currently no available mitigation for this issue.

Common Vulnerability Scoring System (CVSS) Score Details

Info alert:Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).

The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 Score Breakdown

Red HatNVDcve.org
Base Score6.5N/AN/A
Attack VectorNetworkN/AN/A
Attack ComplexityLowN/AN/A
Privileges RequiredNoneN/AN/A
User InteractionNoneN/AN/A
ScopeUnchangedN/AN/A
ConfidentialityLowN/AN/A
Integrity ImpactLowN/AN/A
Availability ImpactNoneN/AN/A

Vector

Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Acknowledgements

Red Hat would like to thank Antony Di Scala and Michael Whale for reporting this issue.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.