Host Header Injection Uncovered: Real-World Examples and Mitigation Tactics
Introduction
Host Header Injection (HHI) is a lesser-known but dangerous web vulnerability that occurs when a web application improperly uses the value of the Host HTTP header to generate dynamic content, perform redirects, or make security decisions. This opens doors for phishing, cache poisoning, password reset hijacking, and more.
This post will explore Host Header Injection, real-world exploitation scenarios, and how to prevent such attacks effectively.
What is Host Header Injection?
The Host header in an HTTP request specifies which domain the client is trying to access. Here's a sample request:
GET / HTTP/1.1
Host: example.com
Many web applications use this header to build links or generate password reset URLs. If user-supplied Host headers are not properly validated, attackers can inject arbitrary values—resulting in malicious redirections or spoofed links.
Real-World Attack Scenarios
1. Password Reset Poisoning
If a web app generates password reset links using the Host header, attackers can manipulate the header to send a link pointing to their domain:
Host: attacker.com
The user receives a reset email with a malicious link, which, once clicked, gives the attacker control over the account.
2. Web Cache Poisoning
By injecting headers like:
Host: malicious.example.com
An attacker can poison shared caches such as Varnish or Cloudflare, serve spoofed content to multiple users, and perform session fixation or cookie theft.
3. Server-Side Request Forgery (SSRF) via Host
Applications that consume internal APIs based on the host header may be tricked into making internal requests and leaking sensitive data.
4. Virtual Host Routing
The backend might route traffic based on the Host value in setups using virtual hosts. Attackers can exploit this to access unintended applications hosted on the same infrastructure.
How to Mitigate Host Header Injection
1. Whitelist Valid Host Headers
Only allow known values:
if ($host !~ ^(example\.com|www\.example\.com)$) {
return 444;
}
In frameworks like Django, use:
ALLOWED_HOSTS = ['example.com']
2. Avoid Using Host for URL Generation
Use fixed server-side values when creating absolute URLs in emails or redirects. Never trust user-supplied host headers.
3. Implement Web Application Firewalls (WAFs)
Modern WAFs can detect and block suspicious Host header manipulations.
4. Monitor and Audit Logs
Log all incoming Host headers and alert them of anomalous values. This helps in detecting ongoing attacks early.
Tools for Detection
Burp Suite: Use intruder or repeater to test Host header behavior.
OWASP ZAP: Built-in passive scanner detects Host Header Injection.
Amass / Nmap: This maps virtual hosts and identifies exposed domains.
Conclusion
Host Header Injection is a silent but potent vulnerability that can compromise user flows. By understanding real-world exploits and applying proven mitigation techniques, developers and DevSecOps teams can significantly reduce the attack surface of modern web applications.
Comments
Post a Comment