Pachno ~ [OPEN] #2892 - Host Header Poisoning

Description

Since the application is not validating the headers value, an attacker can inject the “X-Forwarded-Host” header in order to redirect the response to another domain.

Login to the TBG application with any valid user and perform a search; save it.
Fill out the fields with any value and click on the “Save search” button.
Intercept the request with any proxy tool and add the following header: X- Forwarded-Host: attacker.com.
Click on the “Run to Completion” button to proceed with the request.
As you can see, a 200 OK response was received, proving that it is possible to inject a header in the request.

Jun 27, 2020 (10:53)

@thnguyen could you explain in more detail how this attack would work? I understand the description, but I'm unsure about the effect.