A host header injection vulnerability exists in the NPM package @perfood/couch-auth versions <= 0.20.0. By sending a specially crafted host header in the forgot password request, it is possible to send password reset links to users which, once clicked, lead to an attacker-controlled server and thus leak the password reset token. This may allow an attacker to reset other users' passwords and take over their accounts.
An attacker sends a password reset request with a specially crafted Host header pointing to a server under their control. The application uses the value from the Host header to generate a password reset link sent to the user. When the victim clicks on such a link, they unknowingly send the password reset token to the attacker's server, which can then use it to set a new password and take over the account.
An attacker can gain full control over other users' accounts by intercepting password reset tokens and performing unauthorized password changes.
Update the @perfood/couch-auth package to a version higher than 0.20.0. Apply patches available from the vendor according to the references. Additionally, it is recommended to verify and sanitize the Host header on the server side before using it to generate any links.
NPM package @perfood/couch-auth (couch-auth) in versions <= 0.20.0
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HPerfood Couchauth
APPPerfood≤ 0.20.0