CWE-644

IBM Tivoli Application Dependency Discovery Manager w wersjach 7.3.0.0–7.3.0.10 jest podatny na atak typu HTTP header injection poprzez nagłówek HOST. Podatność uzyskała najwyższy możliwy wynik CVSS 10.0, co oznacza krytyczne zagrożenie dla systemów, na których jest wdrożona.

Podatność typu host header injection w komponencie mailer biblioteki @perfood/couch-auth v0.26.0 umożliwia atakującemu przechwycenie tokenu resetowania hasła i przejęcie konta użytkownika. Jest to krytyczna luka, ponieważ nie wymaga uwierzytelnienia ani żadnych specjalnych uprawnień.

W aplikacji Monica 4.1.2 istnieje podatność typu Host Header Poisoning, umożliwiająca zdalnemu atakującemu podmianę domeny w linku do resetowania hasła wysyłanym do ofiary. Błąd wynika z nieprawidłowej obsługi nagłówka HTTP Host oraz domyślnej braku konfiguracji parametru 'app.force_url'.

Podatność w bibliotekach @fastify/reply-from i @fastify/http-proxy umożliwia atakującemu selektywne usuwanie nagłówków dodanych przez proxy z żądań kierowanych do upstream. Jest to groźne, ponieważ pozwala obejść mechanizmy kontroli dostępu, routingu lub zabezpieczeń realizowane przez proxy poprzez manipulację wartością nagłówka Connection.

Dell Power Protect Cyber Recovery, contains an Authentication Bypass vulnerability. An attacker could potentially exploit this vulnerability, leading to unauthorized admin access to the Cyber Recovery application. Exploitation may lead to complete system takeover by an attacker.

In Honeywell WIN-PAK 4.7.2, Web and prior versions, the header injection vulnerability has been identified, which may allow remote code execution.

A Header Injection issue was discovered in Certec EDV GmbH atvise scada prior to Version 3.0. An "improper neutralization of HTTP headers for scripting syntax" issue has been identified, which may allow remote code execution.

JUNG Smart Visu Server 1.1.1050 contains a request header manipulation vulnerability that allows unauthenticated attackers to override request URLs by injecting arbitrary values in the X-Forwarded-Host header. Attackers can manipulate proxied requests to generate tainted responses, enabling cache poisoning, potential phishing, and redirecting users to malicious domains.

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, an attacker can initiate a password reset for a victim, and modify the host header of the request to a malicious value. The victim will receive a password reset email, with a link to the malicious host. If the victim clicks this link, their reset token is sent to the attacker's server, allowing the attacker to use it to change the victim's password and takeover their account. As of time of publication, it is unclear if a patch is available.

OAuth2-Proxy is an open-source tool that can act as either a standalone reverse proxy or a middleware component integrated into existing reverse proxy or load balancer setups. In versions prior to 7.13.0, all deployments of OAuth2 Proxy in front of applications that normalize underscores to dashes in HTTP headers (e.g., WSGI-based frameworks such as Django, Flask, FastAPI, and PHP applications). Authenticated users can inject underscore variants of X-Forwarded-* headers that bypass the proxy’s filtering logic, potentially escalating privileges in the upstream app. OAuth2 Proxy authentication/authorization itself is not compromised. The problem has been patched with v7.13.0. By default all specified headers will now be normalized, meaning that both capitalization and the use of underscores (_) versus dashes (-) will be ignored when matching headers to be stripped. For example, both `X-Forwarded-For` and `X_Forwarded-for` will now be treated as equivalent and stripped away. For those who have a rational that requires keeping a similar looking header and not stripping it, the maintainers introduced a new configuration field for Headers managed through the AlphaConfig called `InsecureSkipHeaderNormalization`. As a workaround, ensure filtering and processing logic in upstream services don't treat underscores and hyphens in Headers the same way.

A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that using Headers in L7 traffic intentions could bypass HTTP header based access rules.

Algernon is a small self-contained pure-Go web server. Prior to 1.17.8, when algernon is started with --domain (or --letsencrypt, which silently turns on --domain at engine/flags.go:372), the request handler resolves the served directory by joining the configured --dir with the value of the client-supplied Host header. The join is performed by filepath.Join with no validation, so a Host: .. header walks one level above the document root. Subsequent file resolution then exposes everything in that parent directory — arbitrary file read, full directory listing, and, if any .lua file is present, server-side Lua execution. This vulnerability is fixed in 1.17.8.

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Versions up to and including 2.5.3 set ALLOWED_HOSTS = '*' by default, which causes Django to accept any value in the HTTP Host header without validation. The application uses request.build_absolute_uri() to generate absolute URLs in multiple contexts, including invite link emails, API pagination, and OpenAPI schema generation. An attacker who can send requests to the application with a crafted Host header can manipulate all server-generated absolute URLs. The most critical impact is invite link poisoning: when an admin creates an invite and the application sends the invite email, the link points to the attacker's server instead of the real application. When the victim clicks the link, the invite token is sent to the attacker, who can then use it at the real application. As of time of publication, it is unknown if a patched version is available.

Genkit does not properly validate host request headers. Any host on the developer's network, and any website the developer visits (via DNS rebinding), can reach POST /api/runAction on the Dev UI server (default port 4000) and execute any registered Genkit action and read the result. Fixed on 2026-06-18.

Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated attacker can rotate either header to create a new bucket for each request, bypassing rootRateLimiter, badAuthRateLimiter, getKey(), and the getKeyWithUid() fallback used by public endpoints. This permits repeated POST /users/forgotPasswordEmail and verificationEmail requests, mail bombing registered users, consuming Firebase or SMTP quota, evading brute-force protection, and enabling resource exhaustion. Exploitability of cf-connecting-ip depends on deployment topology, but x-forwarded-for and direct-to-origin paths remain affected when those values are not overwritten by a trusted proxy. No fixed version is available as of this review.

A host header injection vulnerability in the HTTP handler component of Crafty Controller allows a remote, unauthenticated attacker to trigger a Denial of Service (DoS) condition via a modified host header

Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, which may allow contamination of unintended data to HTTP response headers. Accessing a crafted URL which points to an affected product may cause malicious script executed on the web browser.

SAP Solution Manager (Diagnostics agent) - version 7.20, allows an attacker to tamper with headers in a client request. This misleads SAP Diagnostics Agent to serve poisoned content to the server. On successful exploitation, the attacker can cause a limited impact on confidentiality and availability of the application.

Craft CMS w wersjach 4.0.0-RC1 i wyższych (przed 4.18.0) oraz 5.0.0-RC1 i wyższych (przed 5.10.0) zawiera podatność SSRF i Arbitrary JavaScript Injection w endpoincie /actions/app/resource-js. Atakujący może manipulować nagłówkami Host lub X-Forwarded-Host, aby zmienić $baseUrl aplikacji i obejść wewnętrzną walidację URL, zmuszając klienta Guzzle do pobrania złośliwego ładunku z serwera kontrolowanego przez napastnika i zwrócenia go jako JavaScript. Podatność pojawia się, gdy assetManager.cacheSourcePaths jest ustawione na false. Problem naprawiono w wersjach 4.18.0 i 5.10.0.

W MediaCrush w wersji 1.0.0/1.0.1 zidentyfikowano podatność. Dotyczy ona nieznanej funkcji pliku /mediacrush/paths.py komponenty Header Handler. Manipulacja argumentem Host prowadzi do improper neutralization of http headers for scripting syntax. Atak można przeprowadzić zdalnie.