Host header injection 취약점 $800

https://pethuraj.com/blog/how-i-earned-800-for-host-header-injection-vulnerability/

How I earned $800 for Host Header Injection Vulnerability - Bug Bounty Writeups

TIP

If the website works with an arbitrary host header, the client can modify the host header to contain anything. This can introduce a security issue if the host header is then used within the application.

Attack Scenario:

1. The attacker sends a reset password request to another user by modifying the Host Header in the request with any malicious site.
2. The user receives an email to reset the password, clicks the link and proceeds further with the malicious link.
3. By this way, an attacker can obtain valid password reset token for any user.

비밀번호를 찾는 페이지에서 패킷을 잡은후

Host 헤더를 악성링크로 변조 

예제에서는 google.com  으로변경

메일이 정상적으로 보내지고 메일을 확인시 주소가 google 로 변경후 token  값이 노출된것을 확인

피해자가 링크를 눌를경우 토큰값을 획득가능