Description

LimeSurvey <= v6.6.1 uses the Request Host Header to construct the password reset link. This allows an attacker to trick the web application into sending a malicious password reset link to the victim, by specifying an arbitrary domain as the Host Header value.

PoC

To exploit this vulnerability, follow the steps below: 1. Send the password reset request by specifying a second host header with an arbitrary domain as value. ![poc](https://github.com/user-attachments/assets/ece0e47c-179f-49d5-8465-8bc088ed99ae) 2. Once the request is sent, the malicious password reset link is forwarded to the victim, allowing an attacker to steal the victim's reset password token by clicking on the link. ![host_header_injection](https://github.com/user-attachments/assets/a35fd864-48ac-4dba-b09b-9167f39e9a1f)

References

- [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-42903](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-42903) - [https://github.com/LimeSurvey/LimeSurvey/pull/3920](https://github.com/LimeSurvey/LimeSurvey/pull/3920)