Catalog/VULNERABILITY/host-header-injection
SCAN-ID: HOST-HEADER-INJECTIONREVISION 2026.4
VULNERABILITYCVSS 6.8 (MEDIUM)

Host Header & Cache Poisoning Scanner

Detect web cache poisoning, password reset link poisoning, and server-side routing hijack via spoofed Host headers.

Technical Scope & Verification Behavior

Injects X-Forwarded-Host, X-Host, and dual Host headers to check if server reflects untrusted domain in emails, asset URLs, or cache keys.

Automated Inspection Checks (7)
Passive URL parameter fuzzing
Non-destructive boundary tests
Header & cookie flag assertions
Differential latency timing

Proof of Concept (PoC) Vector

Canonical test payload dispatched during security surface audits.

Host: evil.com / X-Forwarded-Host: evil.com

Probe Execution Simulator

Watch the probe engine test this signature in an isolated sandbox.

probe-runner (isolated ephemeral container)
Click 'Simulate Check' to watch the headless audit engine test this vector.

Remediation Patch

Hardcoded Base URL in Emails

patch.diff (typescript)
--- a/handler.typescript (Vulnerable)
const resetLink = `https://${req.headers.host}/reset?token=${token}`;
+++ b/handler.typescript (Remediated)
const resetLink = `${process.env.APP_CANONICAL_URL}/reset?token=${token}`;

Never construct sensitive links using dynamic request headers. Always use hardcoded canonical domain environment variables.

AI Agent Prompt (Cursor · Claude · Copilot)

Copy and paste into your editor to refactor this issue automatically.

"Replace req.headers.host with process.env.APP_BASE_URL when generating password reset links and emails."

Run Isolated Check

Test your public domain specifically for Host Header & Cache Poisoning Scanner.

100% passive • No server load

Specification Details

CVSS Score
6.8 / 10.0
Severity Level
MEDIUM
Category
VULNERABILITY
Test Vectors
7 automated
Execution SLA
< 2.5 seconds
False Positive Defense
Strict assertion
Related Standards
#Cache#Host Header#Poisoning

Run continuous monitoring for Host Header & Cache Poisoning Scanner

Audit your site across all 41 vectors automatically on every deploy.

Back to Catalog