Host Header Injection on https://███/████████/Account/ForgotPassword

Summary

Twitter: https://twitter.com/0x1int

Also for this type of Host header injection / cache poisoning bug I will give you advice for fixing this bug. Since I seee your team still didn't validate host header. Though I noticed that host header is not validated on multiple domains. And I'm not sure that you shouldn't keep password reset links and keep new method for password reset such as getting temporary password on your email. Like your team implemented that. Suggested Mitigation/Remediation Actions I'd like to recommend to use $_SERVER['SERVER_NAME'] rather than $_SERVER['HTTP_HOST']. Make sure to check if it matches a whitelist of domains that you serve:

 $domains = ['example.com', 'foo.bar.baz'];
 if ( ! in_array($_SERVER['SERVER_NAME'], $domains)) {
     // error
 }

Despite what its name implies, unless you followed the first solution, $_SERVER['SERVER_NAME'] will also be populated by the Host header value when PHP runs through a "catch all" configuration. Thus, they are both equal unless your HTTP server is properly configured, hence why both solutions above refer to $_SERVER['SERVER_NAME'] - it effectively doesn't matter if you use that or $_SERVER['HTTP_HOST']. $_SERVER['SERVER_NAME'] will also be populated by the Host header value when code runs through a "catch all" configuration. Though they are both equal unless your HTTP server is properly configured, hence why both solutions above refer to $_SERVER['SERVER_NAME'] - it effectively doesn't matter if you use that or $_SERVER['HTTP_HOST']. 1 This is the code to resolve the host header attack. URL have to be specified.

$allowed_domains = array('yourdomain1', 'yourdomain2', 'yourdomain3');
$default_domain  = 'yourprimedomain';

if (in_array($_SERVER['HTTP_HOST'], $allowed_domains, TRUE))
{
    $domain = $_SERVER['HTTP_HOST'];
}
else
{
    $domain = $default_domain;
}

if (! empty($_SERVER['HTTPS']))
{
    $config['base_url'] = 'https://'.$domain;
}
else
{
    $config['base_url'] = 'http://'.$domain;
}

And put this on your header:

<base href="<?php echo base_url(); ?>" />

One more fix:

com.ibm.rules.decisioncenter.check-host = true
com.ibm.rules.decisioncenter.host-whitelist-patterns = <url_patterns>
com.ibm.rules.decisioncenter.check-host. 

If it's set to true then host servers are validated but if it's set to false such as com.ibm.rules.decisioncenter.check-host = false then value will be false obviously. com.ibm.rules.decisioncenter.host-whitelist-patterns this specifies URLs that needs to be validated in a nutshell whitelisted. Make sure to use Regex as a property value so, the ".*" at the end is required to specify any following characters. You can specify several values, separated by a comma. Second thing: Configure a parameter for Rule Execution Server. Try to find In your XML file, ilog.rules.res.TRUSTED_HOSTS_CONFIGURATION parameter. Only if there's XML file:

<context-param>
   <description>
      Host HTTP header protection configuration.
      When enabled, please provide a list of trusted hosts (separated by semicolons).
      Each host must be a valid regular expression.
      Example: enableHostsWhitelist=true,hosts=host1.com;.*\.company\.com;myserver
   </description>
   <param-name>ilog.rules.res.TRUSTED_HOSTS_CONFIGURATION</param-name>
   <param-value>enableHostsWhitelist=false,hosts=</param-value>
</context-param>

When ilog.rules.res.TRUSTED_HOSTS_CONFIGURATION parameter enableHostsWhitelist set to true, the protection against the host header injection is enabled. In this case, enter a list of the host servers that are trusted. You can enter multiple hosts, separated by a semicolon (;). If the ilog.rules.res.TRUSTED_HOSTS_CONFIGURATION parameter is set to false then value will be false. And Repackage and redeploy the Decision Center and Rule Execution Server archives.

Thank you! Have a good day!