CVE-2024-26470
📋 TL;DR
A host header injection vulnerability in FullStackHero's WebAPI Boilerplate allows attackers to leak password reset tokens by manipulating the host header in forgot password requests. This enables unauthorized password resets for user accounts. Affects organizations using versions 1.0.0 or 1.0.1 of this .NET web API boilerplate.
💻 Affected Systems
- FullStackHero WebAPI Boilerplate
📦 What is this software?
.net 9 Starter Kit by Fullstackhero
.net 9 Starter Kit by Fullstackhero
⚠️ Risk & Real-World Impact
Worst Case
Attackers reset passwords for all user accounts, gaining unauthorized access to sensitive data and systems.
Likely Case
Targeted account takeover of specific users through password reset token leakage.
If Mitigated
Limited impact with proper input validation and token security controls.
🎯 Exploit Status
Exploitation requires sending crafted HTTP requests with manipulated host headers to the forgot password endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available or implementing workarounds.
🔧 Temporary Workarounds
Implement Host Header Validation
allAdd server-side validation to reject or sanitize host headers in forgot password requests.
Implement middleware to validate Host header against allowed domains
Disable Forgot Password Functionality
allTemporarily disable the vulnerable forgot password endpoint until a fix is available.
Comment out or remove forgot password route/controller
🧯 If You Can't Patch
- Implement Web Application Firewall (WAF) rules to block requests with suspicious host headers
- Monitor logs for unusual forgot password requests and implement rate limiting
🔍 How to Verify
Check if Vulnerable:
Test by sending a forgot password request with a manipulated Host header and checking if token is leaked in response or logs.Check Version:
Check package version in project file or NuGet package managerVerify Fix Applied:
Verify that host header validation is implemented and test with crafted requests to confirm token leakage is prevented.📡 Detection & Monitoring
Log Indicators:
- Unusual host header values in forgot password requests
- Multiple password reset attempts from same IP
Network Indicators:
- HTTP requests to forgot password endpoint with non-standard host headers
SIEM Query:
source="web_logs" AND uri_path="/api/auth/forgot-password" AND host_header!="expected-domain.com"🔗 References
- https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2024-26470
- https://github.com/fullstackhero/dotnet-webapi-boilerplate
- https://www.nuget.org/packages/FullStackHero.WebAPI.Boilerplate
- https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2024-26470
- https://github.com/fullstackhero/dotnet-webapi-boilerplate
- https://www.nuget.org/packages/FullStackHero.WebAPI.Boilerplate
