Perfood Couch-Auth Host Header Injection Vulnerability Allowing Server-Side Template Injection

A host header injection vulnerability has been identified in the Perfood Couch-Auth NPM package, specifically in versions through 0.21.2. This vulnerability allows for server-side template injection (SSTI) by sending a specially crafted host header in the email change confirmation request. Exploiting this vulnerability could enable an attacker to execute limited commands or leak server-side information.

Impact

Exploitation of this vulnerability could lead to server-side template injection, allowing for the execution of limited commands or the leakage of server-side information.

Reproduction

To reproduce this vulnerability, send a request to the email change confirmation endpoint with a crafted host header. The header should be designed to inject malicious content that will be processed by the server-side template engine. This will trigger the server-side template injection vulnerability.