Your Password Reset Email Carries a Link the Attacker Chose

The reset email was built
the way most of them are.

Generate a token.
Store it.
Build a link.
Send it.

The link needed the site's address,
and the framework offered one,
taken from the request.

So the code asked the request
where it had come from,
and put that at the front of the link.

On every normal day
that is the right answer.

The user is on your site,
so the request says your site.

Now send the request yourself.

Ask for a reset
for somebody else's email address,
and set the Host header
to a domain you own.

Or leave Host alone
and add X-Forwarded-Host,
which the app trusts
because it sits behind a proxy
and somebody once needed it to.

The server generates a real token
for the real account,
and emails the real owner
a real message
from your real address,
with a link that points
at the attacker's domain.

She did not ask for it.

Some people click anyway.

Some mail systems
open every link in a message
to scan it for malware,
and do not need anyone to click.

Either way
the token lands in a log
on somebody else's server,
and the token is the account.

Nothing was forged.

The email passed every check
because you sent it.

The bug is one assumption.

That the address in the request
is the address of the site.

It is not.

It is a string the client typed.

So stop asking.

Put the public base URL in config,
one value per environment,
and build every link in every email
from that.

Reset links.
Invitations.
Verification.
Magic logins.
Unsubscribe.

Then tell the app
which hosts it answers for,
and reject the rest
before any of your code runs.

Have the proxy
overwrite forwarding headers,
not pass along whatever arrived.

And keep the token short lived
and single use,
so a link that went astray
is worth minutes,
not a week.

Test it with one request.

Ask for a reset
with a strange Host,
open the email,
and read where the link points.

If it points anywhere but home,
your reset form
is a phishing service
with your logo on it.

– Serguey Asael Shinder