023 – Uncontrolled external site redirect - Host Header Injection
Description
The server processes requests with the Host header set and redirects clients to any destination.
Impact
- Enumerate the internal network via trial and error. - Perform a subset of Server Side Request Forgery attacks.
Recommendation
Configure server to prevent third party hosts redirection.
Threat
Unauthorized attacker from internet network.
Expected Remediation Time
Score 4.0
Default score using CVSS 4.0. It may change depending on the context of the src.
Base 4.0
- Attack vector: A
- Attack complexity: H
- Attack Requirements: N
- Privileges required: L
- User interaction: N
- Confidentiality (VC): N
- Integrity (VI): L
- Availability (VA): N
- Confidentiality (SC): N
- Integrity (SI): N
- Availability (SA): N
Threat 4.0
- Exploit maturity: X