地图 / Host Header is not validated resulting in Open Redirect

Host Header is not validated resulting in Open Redirect

注入与走私 / 违反安全设计原则（按标题归类） / #7357

厂商: IRCCloud
严重程度: 未评级
赏金: $100
弱点: 违反安全设计原则（按标题归类）
研究员: @anshuman_bh
披露日期: 2014-04-24
资产: —
CVE: —

该报告还没有中文解读。

原文摘录

摘自原文（1205 字符中的一小部分）

Please see the attached screenshot where I am sending a request to irccloud.com with an invalid HOST header and I am getting redirected to that domain. This is because the HOST header is not validated to ensure that the request is originating from that target host or not.

默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 IRCCloud 所有。

时间线

2014-04-12报告提交
2014-04-24公开披露

阅读 HackerOne 原文 ↗作者 @anshuman_bh · 版权归作者与 IRCCloud 所有

同类报告

Web cache poisoning attack leads to user information and morePostmates · — · $500 Access Token Smuggling from my.playstation.com via Referer HeaderPlayStation · 2021-01-12 · $1,000 Cache Poisoning via uppercase letters in invalid pathInnoGames · — · $550 Cache Poisoning DoS on updates.rockstargames.comRockstar Games · 2021-12-22 Web Cache poisoning attack leads to User information Disclosure and moreLyst · 2022-03-22 Web cache poisoning leads to disclosure of CSRF token and sensitive informationSmule · 2019-07-21