Host Header Injection on Password-Reset Functionality Causes Unauthorized Redirect to Attacker-Controlled Domain Where a Users Could be Tricked into Entering Account Credentials for Account Takeover or PII Leak

Host Header Injection on Password-Reset Functionality Causes Unauthorized Redirect to Attacker-Controlled Domain Where a Users Could be Tricked into Entering Account Credentials for Account Takeover or PII Leak

Researcher: Imshadab18

Engagement: National Aeronautics and Space Administration (NASA) – Vulnerability Disclosure Program

Disclosed at: 2025-05-19T21:23:41Z

Priority: P5

Status: Informational

Summary

This is how the “Host” header works in general. No vulnerability is present

Activity Feed

Actor	Details	Timestamp (UTC)
Martin	Martin published	2025-05-19T21:23:41Z
Imshadab18	Imshadab18 requested	2025-05-12T11:16:06Z
viper-bugcrowd	viper-bugcrowd sent a: message	2025-05-12T11:04:00Z
viper-bugcrowd	viper-bugcrowd changed the state to to informational	2025-05-12T11:03:57Z
viper-bugcrowd	viper-bugcrowd updated	2025-05-12T11:03:54Z
Imshadab18	Imshadab18 created the submission	2025-05-12T10:16:52Z

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on “Patreon” or “Buy Me A Coffee” using the buttons below

Buy Me A Coffee

Patreon

To keep up to date follow us on the below channels.

Tags: bug bounty, BugCrowd, OSINT

BugCrowd Bug Bounty Disclosure: P5 – Host Header Injection on Password-Reset Functionality Causes Unauthorized Redirect to Attacker-Controlled Domain Where a Users Could be Tricked into Entering Account Credentials for Account Takeover or PII Leak – Imshadab18

Host Header Injection on Password-Reset Functionality Causes Unauthorized Redirect to Attacker-Controlled Domain Where a Users Could be Tricked into Entering Account Credentials for Account Takeover or PII Leak

Summary

Activity Feed

[KILLSEC] – Ransomware Victim: Medswana

[IMNCREW] – Ransomware Victim: Stiga[.]com

[WORLDLEAKS] – Ransomware Victim: Indigo Group S[.]A[.]

Cobalt Strike Beacon Detected – 156[.]238[.]224[.]164:80

Cobalt Strike Beacon Detected – 111[.]229[.]0[.]18:443

Summary

Activity Feed

You may have missed

[KILLSEC] – Ransomware Victim: Medswana

[IMNCREW] – Ransomware Victim: Stiga[.]com

[WORLDLEAKS] – Ransomware Victim: Indigo Group S[.]A[.]

Cobalt Strike Beacon Detected – 156[.]238[.]224[.]164:80

Cobalt Strike Beacon Detected – 111[.]229[.]0[.]18:443