CVE-2025-61132
📋 TL;DR
A Host Header Injection vulnerability in levlaz braindump v0.4.14 allows attackers to manipulate password reset links by injecting malicious Host headers. This enables password reset poisoning attacks where victims receive password reset emails containing links to attacker-controlled domains, potentially leading to account takeover. The vulnerability affects all deployments using the default configuration.
💻 Affected Systems
- levlaz braindump
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover of all user accounts via password reset poisoning, allowing attackers to reset passwords and gain unauthorized access to sensitive data.
Likely Case
Targeted account takeover of specific users through social engineering combined with password reset poisoning attacks.
If Mitigated
No impact if proper host header validation and SERVER_NAME configuration are implemented.
🎯 Exploit Status
Exploitation requires sending crafted HTTP requests with malicious Host headers to trigger password reset emails. Public proof-of-concept exists in the provided references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Set Flask's SERVER_NAME configuration to a fixed value in app configuration. 2. Implement host header validation middleware. 3. Update to a patched version when available from the vendor.
🔧 Temporary Workarounds
Configure Flask SERVER_NAME
allSet a fixed SERVER_NAME in Flask configuration to prevent url_for from using Host header values
app.config['SERVER_NAME'] = 'your-legitimate-domain.com'
Implement Host Header Validation
allAdd middleware to validate and sanitize Host headers before processing
# Python Flask middleware to validate Host header
from flask import request, abort
@app.before_request
def validate_host_header():
allowed_hosts = ['your-legitimate-domain.com', 'localhost']
if request.host not in allowed_hosts:
abort(400)
🧯 If You Can't Patch
- Implement a web application firewall (WAF) with rules to block malicious Host header injections
- Disable password reset functionality temporarily until patching is possible
🔍 How to Verify
Check if Vulnerable:
Send a password reset request with a malicious Host header (e.g., 'evil.com') and check if the reset email contains links pointing to the malicious domain instead of the legitimate application domain.Check Version:
Check the application version in the source code or package metadata. For braindump, examine the version file or setup.py.Verify Fix Applied:
After implementing fixes, test password reset functionality with various Host headers to ensure all reset links point only to the configured legitimate domain.📡 Detection & Monitoring
Log Indicators:
- Unusual Host header values in HTTP logs
- Multiple password reset requests from single IP with varying Host headers
- Password reset emails sent to unexpected domains
Network Indicators:
- HTTP requests with manipulated Host headers
- Outbound connections to suspicious domains from password reset functionality
SIEM Query:
source="web_logs" AND (Host:*evil* OR Host:*malicious* OR Host:*attacker*) AND uri="/auth/reset_password"🔗 References
- https://drive.google.com/file/d/1FmkctLdOTGMdy6GgLaTzfxemdVDeiA7J/view?usp=sharing
- https://gist.github.com/BrookeYangRui/94c3bee0c2cbc1ed81a21d4448550c21
- https://github.com/levlaz/braindump/blob/9640dd03f99851dbd34dd6cac98a747a4a591b01/app/auth/views.py#L131-L148
- https://github.com/levlaz/braindump/blob/9640dd03f99851dbd34dd6cac98a747a4a591b01/app/templates/auth/email/reset_password.html#L1-L8
- https://portswigger.net/web-security/host-header/exploiting/password-reset-poisoning
