Host Header Injection
MediumHost Header Injection
Definition
Host Header Injection is a vulnerability that occurs when an application blindly trusts the value of the HTTP request's Host header. An attacker can tamper with this header to poison password-reset links, manipulate routing or poison web caches.
Impact
Poisoning of password-reset linksWeb cache poisoningBypassing virtual-host based access controlsInternal Server-Side Request ForgeryRedirection to malicious domains
Examples
Password Reset Poisoning
The application uses the Host header to generate absolute URLs in password-reset emails. By changing it to the attacker's domain, the reset link points to the malicious server, capturing the token when the victim clicks.
# Password-reset request with a tampered Host
POST /api/auth/forgot-password HTTP/1.1
Host: evil.com
Content-Type: application/json
{"email": "victim@example.com"}
# The server generates a link using the Host header:
# https://evil.com/reset-password?token=abc123
# This link is sent to the victim's email
# If the victim clicks, the token is sent to the attacker's server