CVE-2023-39655
📋 TL;DR
This host header injection vulnerability in @perfood/couch-auth allows attackers to send password reset links that redirect to attacker-controlled servers, leaking reset tokens. Attackers can then reset users' passwords and take over accounts. Anyone using affected versions of this NPM package is vulnerable.
💻 Affected Systems
- @perfood/couch-auth
📦 What is this software?
Couchauth by Perfood
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover of all users, leading to data breaches, privilege escalation, and potential lateral movement within systems.
Likely Case
Targeted account takeover of specific users, potentially compromising sensitive data and application functionality.
If Mitigated
Limited impact if proper input validation and host header verification are implemented, though risk remains until patched.
🎯 Exploit Status
Exploitation requires sending a crafted host header to the forgot password endpoint, which is straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: > 0.20.0
Vendor Advisory: https://www.npmjs.com/package/%40perfood/couch-auth
Restart Required: Yes
Instructions:
1. Update package.json to specify @perfood/couch-auth version > 0.20.0. 2. Run 'npm update @perfood/couch-auth'. 3. Restart your application server.
🔧 Temporary Workarounds
Host Header Validation
allImplement middleware to validate and sanitize host headers before processing requests.
Disable Password Reset
allTemporarily disable the forgot password functionality if not critical.
🧯 If You Can't Patch
- Implement strict host header validation at the web server or application firewall level.
- Monitor for suspicious password reset requests and implement rate limiting on the forgot password endpoint.
🔍 How to Verify
Check if Vulnerable:
Check package.json or run 'npm list @perfood/couch-auth' to see if version <= 0.20.0 is installed.Check Version:
npm list @perfood/couch-authVerify Fix Applied:
After updating, verify the installed version is > 0.20.0 using 'npm list @perfood/couch-auth'.📡 Detection & Monitoring
Log Indicators:
- Unusual host headers in forgot password requests
- Multiple password reset requests from single IPs
Network Indicators:
- HTTP requests with manipulated host headers to password reset endpoints
SIEM Query:
source="web_logs" AND (uri_path="/forgot-password" OR uri_path="/reset-password") AND host_header!="expected-domain.com"