Host Header Injection

Detects applications that use the HTTP Host header for URL generation, password reset links, or routing without validation.

zakirkun Updated

File contents

Host Header Injection

Overview

Applications that trust the Host header for generating links (password reset emails, canonical URLs) are vulnerable to Host Header Injection. Attackers set a malicious Host: header, causing the app to generate links pointing to the attacker's domain. The victim clicks a password reset link containing an attacker-controlled URL.

Remediation

  • Configure your web application with an explicit trusted host list
  • Use Django's ALLOWED_HOSTS, Laravel's config/app.php URL, or server-side canonical URL
  • Validate the Host header against an allowlist before using it

zakirkun/ice-tea/tree/main/skills/web/host-header-injection commit 1d5d80f42d

Frequently asked questions

npx skillmds@latest add zakirkun/host-header-injection