An attacker can manipulate the Host header as seen by the web application and cause the application to behave in unexpected ways.
Very often multiple websites are hosted on the same IP address. This is where the Host Header comes in. This header specifies which website should process the HTTP request. The web server uses the value of this header to dispatch the request to the specified website. Each website hosted on the same IP address is called a virtual host.
But what happens if we specify an invalid Host Header? If Apache receives an unrecognized Host Header, it passes it to the first virtual host defined in httpd.conf. Therefore, it's possible to send requests with arbitrary Host Headers to the first virtual host.
Another way to pass arbitrary Host headers is to use the X-Forwarded-Host Header. In some configurations this header will rewrite the value of the Host header. Therefore it's possible to make a request like:
Hello udacity Security Team,
This is Ratnadip Gajbhiye an Independent Security Researcher.
Vulnerability Name & Description: Host Header Injection Attack - http://cn.udacity.com/
An attacker can manipulate the Host header as seen by the web application and cause the application to behave in unexpected ways.
Very often multiple websites are hosted on the same IP address. This is where the Host Header comes in. This header specifies which website should process the HTTP request. The web server uses the value of this header to dispatch the request to the specified website. Each website hosted on the same IP address is called a virtual host.
But what happens if we specify an invalid Host Header? If Apache receives an unrecognized Host Header, it passes it to the first virtual host defined in httpd.conf. Therefore, it's possible to send requests with arbitrary Host Headers to the first virtual host.
Another way to pass arbitrary Host headers is to use the X-Forwarded-Host Header. In some configurations this header will rewrite the value of the Host header. Therefore it's possible to make a request like:
POC Request::
GET /assets/ HTTP/1.1 Host: bing.com Accept-Encoding: gzip, deflate Accept: / Accept-Language: en User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0) Connection: close Cookie: ajs_user_id=null; ajs_group_id=null; ajs_anonymous_id=%22ec610e52-953c-4e50-bb79-20d63abfb910%22; vero_visit=true; _gaexp=GAX1.2.AcMkzat1SniVIFl9v1S1uA.17790.1; _hjClosedSurveyInvites=79978; __veroc4=%5B%5D; _gat=1; intercom-id-av16vnft=a8a83655-ef73-49b5-a187-b0fb916dc7a1; cfduid=db3bc3d3cd4e7b104c75cfeae5d11f6c11530719700; optimizelyEndUserId=oeu1530719899431r0.19598789419004137; optimizelyBuckets=%7B%7D; optimizelyPendingLogEvents=%5B%5D; _omappvp=NXAmyo3lN8CEEGSoYkYspnkUPUeJZirF9eqjqx9zzpSW6xGSGsRgM548DbLdkMqPzdybSygQ1BpLiPTbisEmTdciMCB1fFuW; _bs=ec610e52-953c-4e50-bb79-20d63abfb910; optimizelySegments=%7B%222323520508%22%3A%22ff%22%2C%222358950564%22%3A%22false%22%2C%222378170072%22%3A%22referral%22%7D; _omappvs=1530720280107; _gat_UA-28524234-29=1; _gat_customBotGaTracker1=1; _gat_customBotGaTracker2=1; _gat_rupertBotGaTracker=1; _auth_redirect_to=/me; _ga=GA1.2.1555421300.1530718466; _gid=GA1.2.230910605.1530718466; ADHOC_MEMBERSHIP_CLIENT_ID1.0=85dff6af-d14c-66bc-88cc-e3f3bf415329; Hm_lvt_63b9431008f0510d1043a42c7aaa6cee=1530721182; Hm_lpvt_63b9431008f0510d1043a42c7aaa6cee=1530721182; instapage-visit-5030783=%7B%22ref%22%3Anull%2C%22A%22%3A%7B%22b%22%3A1%2C%22d%22%3A1530721161%7D%7D
POC Response::
HTTP/1.1 301 Moved Permanently Content-Type: text/html Date: Wed, 04 Jul 2018 16:50:40 GMT Location: http://bing.com/assets Server: nginx/1.12.1 Content-Length: 185 Connection: Close
301 Moved Permanently
POC Payload: Host: bing.com
POC Picture: ScreenShot Enclosed in Attachment.
I Hope You will Fixed this soon,
Thanks & Regards Ratnadip Gajbhiye
Host Header Injection Attack References: https://hackerone.com/reports/13286 https://hackerone.com/reports/158019 https://hackerone.com/reports/235281