Host Header Injection

Detects applications that use the HTTP Host header for URL generation, password reset links, or routing without validation.

zakirkun 1d5d80f 2 files · 2.2 KB Updated

File contents

Host Header Injection

Overview

Applications that trust the Host header for generating links (password reset emails, canonical URLs) are vulnerable to Host Header Injection. Attackers set a malicious Host: header, causing the app to generate links pointing to the attacker's domain. The victim clicks a password reset link containing an attacker-controlled URL.

Remediation

  • Configure your web application with an explicit trusted host list
  • Use Django's ALLOWED_HOSTS, Laravel's config/app.php URL, or server-side canonical URL
  • Validate the Host header against an allowlist before using it

zakirkun/ice-tea/tree/main/skills/web/host-header-injection commit 1d5d80f42d

Frequently asked questions

npx skillmds@latest add zakirkun/host-header-injection