So reading this blog post, I know how the password reset works and how it's exploitable, but in a real case scenario, how would XSS be possible? Is there a way to send a victim to a page with the host header edited?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
The article mentions this example: http://carlos.bueno.org/2008/06/host-header-injection.html
i.e. cache can get served up to victims which will have them using the evil host header. This might even be done by the CDN / reverse proxy / load balancers etc directly in front of a big website, affecting a very large number of their visitors potentially depending on if the page is one which works well for cache hits. It could also be done by caching at ISP's etc which are out of reach for a site to be able to quickly fix it.
"The second half of the vulnerability comes when there is HTTP caching going on somewhere on the path between the site and users. This could be a caching proxy run by the site itself, or downstream in ISP proxies, content delivery networks (CDNs), syndicators, etc. This allows an attacker to potentially rewrite URLs on any page he wishes, and embed that exploited page in caches that may be beyond the control of the victim site."