Add Password Reset Token Leakage via Host Header Poisoning on Password Reset Function

Summary: I would like to propose an addition to the VRT for Token Leakage via Host Header Poisoning on Password Reset function. I have found this vulnerability on several programs and have not found an appropriate vulnerability in the VRT.

Scenario: An attacker is able to send a password reset request for a user’s account with the Host: header set to their server. When the user receives the password reset email, it arrives from the legitimate email address, however, the host header poisoning causes the password reset link to point at the attackers server. If the victim clicks on the password reset link, the password reset token is sent to the attacker’s server where it can be retrieved from server logs. The attacker can then take this token and use it to takeover the account.

Impact: I believe that this should have a technical severity of P2 as this can be used to takeover an account, however, it does require user interaction.

VRT Suggestion: I’m not sure what the best category for this would be. But here’s a shot: P2: Sensitive Data Exposure > Weak Password Reset Implementation > Token Leakage via Host Header Poisoning

[plr0man]

After additional review the team agreed that while Server Security Misconfiguration might be a slightly better fit for this entry, it is not ideal to add yet another Weak Password Reset Implementation subcategory there. That being said we’ll go with the initial recommendation, which has already been pushed to #205.

[plr0man]

A quick update here. We decided to change the category from Sensitive Data Exposure to Server Security Misconfiguration: P2: Server Security Misconfiguration > Weak Password Reset Implementation > Token Leakage via Host Header Poisoning