From official ASP.NET Core docs, namely Routing in ASP.NET Core § URL generation concepts:
Use GetUri* extension methods with caution in an app configuration that doesn't validate the Host header of incoming requests. If the Host header of incoming requests isn't validated, untrusted request input can be sent back to the client in URIs in a view or page. We recommend that all production apps configure their server to validate the Host header against known valid values.
(for those who don't know ASP: my understanding is that the
GetUri* methods generate self-referential URIs by using the value of the Host header for the domain)
How can this be insecure?
I know that the Host header is in the control of the client. However, all such an "attack" can achieve is to substitute a link on a webpage with an "attacker"-generated value. This can be easily done with the browser console: just find a link and edit it. I can't see why would one want to do this either way.
I must be missing something. What harmful, malicious things can an attacker achieve by tricking the server to sent them back a link crafted by them?