What are Host Attacks? How to Avoid Host Attacks Successfully?

Web servers are configured in a way that allows them to host a number of different web applications and websites on the same IP address. It is the reason why the host header exists. The host header specifies which web application or website is responsible for processing the incoming HTTP request. The web server then makes use of the header value for dispatching the request to the specified web application.

More Info: 312-38: Certified Network Defender (CND)

But what would happen when someone specifies an invalid host header? It can lead to host attacks. In this article, we will discuss host attacks and what are the different host attack vulnerabilities.

What are Host Attacks?

HTTP host attacks look to exploit the vulnerability of websites that handle the host header’s value in an unsafe manner. For instance, if the webserver trusts the host header implicitly and does not validate it properly, the attacker might inject harmful payloads, which will manipulate server-side behavior. Attacks that involve the process of injecting harmful payloads directly inside the host header are referred to as host attacks.

Attackers can also use the header value in several different interactions between various websites’ infrastructure systems. Because the header is controllable, this can lead to a wide range of issues. If the input is not validated accurately, the host header can become a potential vector for exploiting many different vulnerabilities. Some of these vulnerabilities include web cache poisoning and password reset poisoning, among others.

Host Attacks Vulnerabilities

1. Web Cache Poisoning

Web cache is one of the techniques used by cyber attackers looking to manipulate web cache so that they can serve poisoned content to anyone who is requesting the web page.

For this to occur, the cyber attacker will have to poison a caching proxy run by the website itself, content delivery networks, downstream providers, or any other caching mechanism between the server and the client. After this, the cache will serve the poisoned content to anyone who is requesting the web page, with the victim of the attack having no control whatsoever over the infected content that is being served to them.

2. Password Reset Poisoning

One of the most common ways to implement the password reset functionality is to generate a secret token and then send the link through email containing the token. What will happen if the cyber attacker request a password reset with the host header controlled by the attacker?

If the website uses the host header value when composing the reset link, the cyber attacker gets the ability to poison the password reset link sent to the victim. Therefore, when the victim clicks on the poisoned password reset link in the email, the cyber attacker will be able to access the password reset token and then change the victim’s password without any troubles.

How to Mitigate Host Attacks?

The following are the different ways to mitigate the risk of host attacks from taking place at your organization.

1. Do a proper validation of the request. Make sure if the request came from the original target or not.

2. Ensure that you whitelist all of the trusted domains in the initial phase of the web application.

3. Try to mitigate the host attacks in Nginx and Apache by creating a dummy virtual host that catches all requests from unrecognized host headers.

4. Ensure that your organization is making use of secure server configuration.

Tools to Find Host Header Vulnerability

The following are the two different tools used by SOC Analysts to find the host header vulnerability.

1. Brisk InfoSec’s BHHIT

2. XFORWARDY

Source: eccouncil.org