T09 · Insecure Skill Coding Practices
- Location
servers.md:72- Finding
Host Header Injection Enables Open Redirects
- Content
View full analysis
Vulnerability Details
File Location:
servers.md:72-75
Vulnerability Type: Host header injection / open redirect
Risk Level: MediumVulnerable Code
javascript http.createServer((req, res) => { res.writeHead(301, { Location: `https://${req.headers.host}${req.url}` }); res.end(); }).listen(80);Technical Analysis
The documented Node.js HTTP-to-HTTPS redirect constructs the
Locationresponse header directly fromreq.headers.host. The HTTPHostheader is supplied by the client and is not validated against a trusted hostname or allowlist.An attacker can therefore submit a request containing an attacker-controlled
Hostvalue. The server will incorporate that value into the redirect destination and return a legitimate HTTP redirect to the attacker-selected domain.Attack Path
- A victim-facing deployment copies the documented redirect implementation.
- The attacker sends a request to the HTTP endpoint with a manipulated header, such as:
http GET /login HTTP/1.1 Host: attacker.example - The server constructs the following response header:
http Location: https://attacker.example/login - A browser or another redirect-following client navigates to the attacker-controlled destination.
- The attacker can imitate the legitimate service at that destination to facilitate phishing or credential theft. The flaw may also affect intermediaries that cache redirects without safely separating responses by hostname.
Impact Assessment
Exploitation does not directly grant operating-system, application, or administrative privileges. It grants control over the redirect destination generated by the affected HTTP listener.
The practical scope includes phishing, redirection of users to attacker-controlled infrastructure, abuse of trust associated with the legitimate service URL, and possible cache poisoning where an improperly configur ...[truncated 175 chars]
- Remediation
View remediation
Remediation Suggestions
Do not construct security-sensitive redirect destinations from an untrusted
Hostheader.-
Use a fixed canonical hostname:
javascript const CANONICAL_ORIGIN = 'https://example.com'; http.createServer((req, res) => { const path = req.url?.startsWith('/') ? req.url : '/'; res.writeHead(308, { Location: `${CANONICAL_ORIGIN}${path}` }); res.end(); }).listen(80); -
If multiple hostnames must be supported, parse and validate the hostname against an explicit allowlist before generating the redirect. Reject unrecognized or malformed values rather than reflecting them.
-
When operating behind a reverse proxy, define trusted proxy boundaries explicitly. Do not trust
Host,X-Forwarded-Host, or similar forwarded headers unless they are overwritten by a trusted proxy. -
Add automated tests that send arbitrary and malformed
Hostvalues and verify that the response either redirects to an approved canonical origin or rejects the request. -
Configure the edge proxy or web server to reject unknown hostnames as an additional defense-in-depth measure.
-