3

I'm able to inject JavaScript payload in HOST header, a request will look like:

Host: <script>alert(document.cookie)</script>
User-Agent: Mozilla/5.0 Gecko/20100101 Firefox/29.0

Cookie got alerted with no problem.

My question is: is this exploitable? Or is it a Self-XSS because I don't know how to send the victim a specific HOST header?

Improve this question
6
  • Where and how are you modifying the host header? Is the server returning the javascript? Are you using greasemonkey to modify the page as it sits in your browser?
    – atk
    Jul 27, 2014 at 22:25
  • 1
    Technically, it is some kind of code injection. However, since I don’t see a way to make a victim’s browser to send this Host header field value to a specific server, I wouldn’t call it Cross-Site Scripting.
    – Gumbo
    Jul 28, 2014 at 7:00
  • it may have no exploit in standard browsers, but that doesn't make it unexploitable and it doesn't make it not-xss. It simply makes it unexploitable in standard browsers. Other clients may be exploitable. Some nonstandard browser may be vulnerable. That does lower the risk possibly to the point of being uninteresting, but, again, doesn't mean it's not xss.
    – atk
    Jul 28, 2014 at 7:50
  • Thanks atk \n Gumbo : i think it is possible to make a request with javascript(xmlhttprequest) and set the header HOST to our payload , then it may be exploitable then.
    – user1675137
    Jul 28, 2014 at 8:23
  • @user1675137 Only if it does not follow the XMLHttpRequest specification as you are not allowed to set Host request header field.
    – Gumbo
    Jul 28, 2014 at 9:49

2 Answers 2

Reset to default
1

HTTP headers are like any other user data, and should be sanitized by webapplications.

You might be able to use it to XSS yourself when you go to a "whats my ip" kind of website that displays this kind of information, if it's been built by developers who assumed HTTP headers are OK to send back to the user.

I've seen happen in a webapplication to view logs of server traffic. So if you can find an application that stores the HTTP headers, and is stupid enough to return them in HTML unsanitized, and it's displayed to someone other than who sent the headers, then yes it's exploitable. But again, this is like any other user data.

Improve this answer
2
  • I know the headers are like any user data , but i never someone who stored headers in html file . in my case , when changing the header, an error message appear (NOT VALID {HEADER}) . i think in this case noting is exploitable . Thanks Philipp
    – user1675137
    Jul 31, 2014 at 6:27
  • Host is (normally) the name of the server, so a whats-my-ip site would not use it for client IP. (But the possible vectors for webapp in general still apply.)
    – dave_thompson_085
    Aug 23, 2014 at 17:46
0

Improper escaping/encoding (which in this case leads to XSS vulnerability) could be exploited. The main condition which must occur is improper HTTP cache handling.

If tested webapplication is vulnerable to HTTP cache poisoning, then your are able to exploit your XSS-finding.

  1. Attacker sends own Host header to the webapplication.
  2. Cache "saves" that fake-header and serves the evilly-modified content to other users.
  3. Attacker repeats the attack.

More info. about HTTP cache poisoning could be find here

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.