MediaCrush Host Header Injection Vulnerability in Header Handler Component

A vulnerability exists in MediaCrush versions 1.0.0 and 1.0.1, specifically within the Header Handler component. The issue arises in the file 'mediacrush/paths.py', where the application improperly validates the Host header in incoming HTTP requests. This flaw allows remote attackers to manipulate the Host header, leading to various potential exploits such as cache poisoning, unauthorized password reset link manipulation, and other attacks that exploit Host header vulnerabilities.

Impact

Exploitation of this vulnerability allows for improper neutralization of HTTP headers, creating opportunities for cache poisoning, manipulation of password reset links, and other Host header-related attacks.