Impact

The admin url can be discovered without prior knowledge of its location by exploiting the X-Original-Url header on some configurations.

Patches

The bug comes from the Zend library.

Workarounds

Unset the X-Original-Url header in the web server configuration.

Resources

https://hackerone.com/bugs?subject=openmage&reportid=3416312

Upon deeper investigation, it was initially not found, but then it was realized that the search excluded the vendor/ directory. This is coming from the ZendController module. Here is another tip from 2016 - it is surprising that this was not somehow patched already!

https://peterocallaghan.co.uk/2016/12/magento-poisoning-cache/ (dead link now..)

Credit

Anees Hyder (anees0xdev) on HackerOne https://hackerone.com/anees0xdev/hacktivity?type=user