JobCenter Host Header Injection Vulnerability Leading to Account Takeover

A vulnerability in JobCenter versions through 7e7b0b2 allows for account takeover via the password reset feature. The issue arises because the SERVER_NAME is not properly configured, causing the password reset process to rely on the Host HTTP header. This vulnerability can be exploited by manipulating the Host header to redirect the password reset link to a malicious domain, intercepting the reset token.

Impact

Exploitation of this vulnerability allows for remote account takeover.

Remediation

To address this vulnerability, configure the SERVER_NAME in the application settings, sanitize or validate the Host header, and remove the '_external=True' option from the url_for function if it is not absolutely necessary.