Skip to main content

Uncontrolled external site redirect - Host Header Injection

Need​

Prevention of unauthorized external site redirects

Context​

  • Usage of C# for building robust and scalable applications
  • Usage of Microsoft.AspNetCore.Mvc for building web applications with ASP.NET Core
  • Usage of Microsoft.AspNetCore.Http for handling HTTP requests and responses in ASP.NET Core applications

Description​

Non compliant code​

public class HomeController : Controller
{
    public IActionResult Index()
    {
        var host = Request.Headers["Host"].ToString();
        return Redirect(host);
    }
}

In this piece of code, the server processes requests with the Host header set and redirects clients to any destination. The HomeController class has an Index action method that reads the "Host" header from the request and uses it to redirect the user.

This is a classic example of an uncontrolled external site redirect vulnerability, also known as Host Header Injection. An attacker could manipulate the Host header to redirect the user to a malicious website. This could be used for phishing attacks, stealing sensitive information, or distributing malware.

The vulnerability lies in the fact that the application blindly trusts the Host header's value and uses it for redirection without any validation or sanitization. This means that an attacker can control the redirection destination by simply changing the Host header value in the request.

It's important to note that this vulnerability can be exploited not only to redirect users to malicious websites but also to trick the application into generating incorrect links, potentially leading to further security issues.

Steps​

  • Validate and sanitize the input from the Host header to prevent any malicious input.
  • Implement a whitelist of allowed hosts to redirect to, instead of redirecting to any destination.
  • Use a secure redirect method that does not rely solely on the Host header, such as using a predefined list of valid URLs or using a configuration file to store the allowed redirect URLs.
  • Consider implementing a secure redirect mechanism that checks the validity of the redirect URL before performing the redirect.
  • Ensure that the redirect URL is properly encoded to prevent any potential injection attacks.
  • Regularly update and patch the application and its dependencies to mitigate any potential security vulnerabilities.

Compliant code​

public class HomeController : Controller
{
    private readonly List<string> _allowedHosts = new List<string> { "www.example.com", "example.com" };

    public IActionResult Index()
    {
        var host = Request.Headers["Host"].ToString();
        if (_allowedHosts.Contains(host))
        {
            return Redirect(host);
        }
        else
        {
            return BadRequest("Invalid host");
        }
    }
}

The original code was vulnerable to Host Header Injection attacks because it blindly trusted the Host header in the HTTP request to determine the redirect location. This could allow an attacker to manipulate the Host header to redirect users to a malicious site.

The fixed code mitigates this vulnerability by implementing a whitelist of allowed hosts. When a request is received, the Host header is checked against this whitelist. If the host is in the whitelist, the redirect is performed as usual. If the host is not in the whitelist, the server responds with a BadRequest status, indicating that the request could not be processed due to client error.

This solution ensures that only valid hosts are allowed for redirection, preventing attackers from exploiting the Host Header Injection vulnerability. It's important to note that the list of allowed hosts (_allowedHosts) should be carefully managed and updated as necessary to ensure it only contains trusted hosts.

Additionally, it's recommended to regularly update and patch the application and its dependencies to mitigate any potential security vulnerabilities.

References​

Last updated on