To understand the horde header injection, we must first look at what a host header is, how it works, and how to manipulate it to inject malicious subject, poison web caches, readjust passwords, and more .
here ’ s what you need to know about the horde header and this injection attack .

What is an HTTP Host header?

The HTTP host header is a request header that specifies the sphere that a customer ( browser ) wants to access. This header is necessary because it is reasonably standard for servers to host websites and applications at the same IP address. however, they don ’ triiodothyronine automatically know where to direct the request .
When the waiter receives a request, it checks the host header parameter to determine which sphere needs to process the request and then dispatches it. Sometimes the header may be amended in being routed to the appropriate knowledge domain. That is where the host header injection may occur.

The reason many websites are hosted on one IP address is due to, on one hand, the debilitation of IPv4 addresses, a well as due to the popularity of mottle host .
There are two independent ways multiple websites are accessible under the lapp IP address. First, these are the cases when there is a virtual master of ceremonies or an mediator organization .

Virtual host 

When multiple websites or applications are hosted on one server, this is known as virtual host. The server has a individual IP address in this scenario, and received requests are routed to the relevant domains .

Intermediary systems

alternatively, multiple websites can be found on one IP address when mediator systems are used. In this case, a web site may be located on a separate server but is accessed via an mediator such as a reverse proxy waiter, a contentedness delivery network ( CDN ), vane syndication, or some other form of traffic route .
For similar reasons as above, this requires indication for the mediator about where to direct incoming requests .

What is the function of the HTTP Host header?

Given that websites and applications don ’ t have their own personal IP addresses, the aim of the master of ceremonies header is to provide the server with information about the proper recipient of the request located downriver .
The host header specifies which domain ( back-end ) hosted with the server should receive and process the node ’ s request, and the server forwards it consequently. The back-end then responds to the request following the lapp path since it doesn ’ t know how the request entered the network .

HTTP Host header example

For case, if you wanted to view our main web log page, the request would include the follow host header :

GET /security-penetration-testing-blog HTTP/1.1

so what happens if the master of ceremonies header in the request is flawed ? unfortunately, most servers are configured to serve the first virtual host ( i.e., a default web site ) to requests that don ’ t have a recognizable horde heading .
Since the host header is user-controlled, sending requests with arbitrary host headers to the first virtual host on any server is possible. It is potential because there is no way to check whether the knowledge domain included in the host header corresponds to the IP address region of the initial Transmission Control Protocol ( TCP ) handshake. indeed in impression, anyone who can manipulate the entrance request can tamper with the host header .
This opens the door for host header injections that manipulate server-side behavior and serve malicious message to users .

What are Host header injections?

A host header injection exploits the vulnerability of some websites to accept host headers promiscuously without validating or all in all escaping them .
This is dangerous because many applications rely on the host heading to generate links, import scripts, determine the proper redirect address, generate password reset links, etc. sol when an application retrieves the host header, it may end up serving malicious contented in the response injected there .
An example would be a request to retrieve your e-banking web page : hypertext transfer protocol : // .
If the attacker can tamper with the host header in the request, changing it to https : //, this fake web site could be served to users and trick them into entering their login credentials .
The above is a harsh example of how a host header could be injected. A successful host header injection could result in web cache poison, password reset poison, access to internal hosts, cross-site script ( XSS ), bypassing authentication, virtual host brute-forcing, and more !
Following are the two chief HTTP host header injection scenarios .

Web cache poisoning

Web cache poison occurs when an attacker can manipulate a hoard proxy server or other mediator systems served by a web site .
For this function, the attacker must first poison the proxy itself. once they have achieved this, they can capture unexpecting users looking for a specific web site and provide them with a forge one .
Depending on the specific case, this is done by changing the host header, using multiple host headers, or using the X-Forwarded-Host heading. The latter is used when an application rejects host headers that are tampered with. In perfume, these are just different approaches toward the end goal of serving poisoned content .
If users are fooled successfully, they may end up running scripts that open the door for early attacks.

Password reset poisoning

Another impingement that a host header injection can have is to poison the password reset functionality. As a leave, they can trick users into clicking a readjust radio link and then resetting and capturing their fresh password. For understanding this problem, it ’ randomness necessary to understand the difference between relative and absolute URLs .

Relative and absolute URLs

For the most function, websites and applications do not need to know the knowledge domain they operate under and provide relative URLs rather of absolute ones. relative URLs are a better choice from a development perspective and offer greater security .
however, an absolute URL is required in certain instances, such as when links are generated in response to a password reset request. In summation, an absolute URL is necessary because users will be coming to the web site from the external, so they need to know the dispatch sphere cover .
If a vane application uses the host header when generating the reset link, this creates the hypothesis for it to serve a poison liaison to users if the host header has been tampered with. If users do not pay attention to the connect and the web site looks similar to what they are expecting, they can efficaciously deliver their credentials to attackers .
HTTP Host Header Attack: Explanation and Examples - Crashtest Security

Host header injection vulnerabilities

Host header vulnerabilities may arise for respective reasons. First, even if the host header is handled carefully, there are ways to override the server and perform an injection. many vulnerabilities are due to default shape options on the server-side or when third-party components are integrated without being by rights secured .
coarse reasons for this type of injection attack include :

  • Servers accepting arbitrary or malformed host headers due to a default or fallback option
  • Flawed domain validation that allows attackers to tamper with the port or insert a random subdomain
  • Ambiguous requests that contain duplicate host headers, absolute URLs in the request line, along with a host header, indented headers, etc.
  • Smuggled HTTP requests 
  • Injected override headers such as X-Host, X-Forwarded-Server, and others

How to prevent Host header attacks?

Depending on your configuration character, there are different ways you can prevent master of ceremonies header injections. Of course, the most square approach is to distrust the host header at all times and not use it in server-side code. This simple change can basically eliminate the hypothesis of a host header fire being launched against you .
however, this may not constantly be potential, and if you need to use the host header, you should consider implementing the keep up measures .

Use relative URLs as much as possible.

startle by considering whether your absolute URLs are vital. frequently, it is possible to use relative URLs alternatively .
If you need to use specific absolute URLs, such as transactional emails, the world must be specified in the server-side shape file and taken from there. This eliminates the possibility of password reset poisoning, as it will not refer to the horde header when generating a nominal .
User remark must constantly be considered insecure and should be validated and sanitized first. One way to validate host headers, where needed, is to create a whitelist of allow domains and check host headers in incoming requests against this list. respectively, any hosts that are not recognized should be rejected or redirected .
To understand how to implement such a whitelist, see the relevant framework documentation .
When validating host headers, you must besides establish whether the request came from the original aim host or not .

Whitelist trusted domains

already at the development stage, you should whitelist all entrust sphere names from which your reverse proxy, lode balancer, or early mediator systems are allowed to forward requests. This will help you prevent routing-based attacks such as a server-side request counterfeit ( SSRF ) .

Implement domain mapping

Map every beginning server to which the proxy should serve requests, i.e., mapping hostnames to websites .

Reject override headers

Host override headers, such as X-Host and X-Forwarded-Host, are frequently used in heading injections. Servers sometimes support these by default, so it ’ second essential to double-check that this is not the casing .

Avoid using internal-only websites under a virtual host

Host headers injections can be used to access internal ( private ) domains. Avoid this scenario, do not host public and individual websites on the like virtual host .

Create a dummy virtual host

If you use Apache or Nginx, you can create a dummy virtual master of ceremonies to capture requests from unrecognized host headers ( i.e., forged requests ) and prevent hoard poisoning .

Fix your server configuration

Host header injections are frequently due to default settings, and defective or old server configurations. Inspecting and fixing your server shape can eliminate significant vulnerabilities that open the door for injections .

Try our automated HTTP header scanner

Take me there


What is a Host header injection?

The HTTP host header injection is an assail in which a malevolent actor tampers with the host header in a customer request. This misleads the virtual server or mediator system to serve poison content to the client in the response.

Are Host header attacks dangerous?

Host header injections can potentially be dangerous as they may lead to a poisoned network cache or poisoned password readjust functionality. fortunately, they are easily prevented with the proper waiter shape .

How to avoid Host header attacks?

Most importantly – do not trust host headers at all or without proper prior validation. If you have no other choice but to use host headers, implement a whitelist of allowed domains .

What are the risks associated with a Host header injection?

A successful host header attack can lead to many unlike issues such as a poison web cache or poisoned password reset, cross-site script or server-side counterfeit requests, SQL injections, session commandeer, and more .

Leave a Reply

Your email address will not be published.