V4 - Access Control

Weak Password Reset Implementation - Token Leakage via Host Header Poisoning

POC

1) Click on reset the password on the application

2) Intercept the HTTP request in Burp Suite

3) Change the Host field to www.evilsite.com

4) If step 3 doesn’t work out then add a new header X-Forwarded-Host: evil.com in the request.

5) The user will get a link like http://evil.com/reset_password/token when they click on it, and the attacker receive the reset password token and hijack the user account

Impact

High

Likelihood

High