REDIRECTION VULNERABILITY/HOST HEADER INJECTION VULNERABILITY

How it was found

Hiii..

This is vyshnav nk i need to address you a vulnerability i have found in https://github.com/blockstack/blockstack-core/

https://github.com/blockstack/blockstack-core/ is vulnerable to host header injection/redirection vulnerability..

IMPACT:-

Attack vectors are somewhat limited but depends on how the host header is used by the back-end application code. If code references the hostname used in the URL such as password reset pages, an attacker could spoof the host header of the request in order to trick the application to forwarding the password reset email to the attackers domain instead, etc. Other attack vectors may also be possible through manipulation of hyperlinks or other misc. code that relies on the host/domain of the request

poc:--

HTTP/1.1 301 Moved Permanently Content-Length: 0 Location: https://github.com.evil.net/blockstack/blockstack-core/index.html

‌HERE WE CAN SEE THAT ORIGINAL WEBSITE IS REDIRECTED TO THE FAKE EVIL.NET WEBSITE...so it is vulnerable to redirection/host header injection vulnerability..

steps to reproduce:---

. i have used CURL command in linux to determine the vulnerability

curl -H Host:evil.net https://github.com/blockstack/blockstack-core/ -i

which will give you the exact result of the redirection vulnerabilty

if you search Google for this vulnerability, there are many, many blogs, articles and white papers describing this vulnerability and associated attack vectors. Every major commercial web application scanner like Accunetix will report this same vulnerability. For more details, please read: https://www.acunetix.com/blog/articles/automated-detection-of-host-header-attacks/.

Normally, most apps will reject any request that doesn't originate from the same origin . To fix, the application should reject anything that doesn't match the target domain.This may also be an error in the rewrite functions of the back-end web server as well.

this may lead to the cache poisoning and the hijacking password reset token

thanks

vyshnav nk

Impact

Attack vectors are somewhat limited but depends on how the host header is used by the back-end application code. If code references the hostname used in the URL such as password reset pages, an attacker could spoof the host header of the request in order to trick the application to forwarding the password reset email to the attackers domain instead, etc. Other attack vectors may also be possible through manipulation of hyperlinks or other misc. code that relies on the host/domain of the request