jameschz Hush Framework Host Header Injection Vulnerability in Util.php

A host header injection vulnerability has been identified in jameschz Hush Framework version 2.0. The issue resides in the file Hush\hush-lib\hush\Util.php, within the HTTP Host Header Handler component. The vulnerability arises from the application directly using the HTTP Host header value from $_SERVER['HOST']' to generate URLs and output, without proper validation or sanitization. This flaw allows remote attackers to manipulate the Host header and inject malicious content, leading to various impacts such as web cache poisoning, open redirects, cross-site scripting, server-side request forgery, and manipulation of account-related links.

Impact

Exploitation of this vulnerability can lead to host header injection, allowing for improper neutralization of HTTP headers, which could be used to inject scripting syntax that is executed by the client's browser.