Backdrop CMS Host Header Injection Vulnerability Allowing Session Hijacking

A host header injection vulnerability has been identified in Backdrop CMS version 1.32.1. This vulnerability allows attackers to manipulate the host header in password reset requests, potentially leading to redirects to malicious domains. Such an attack could facilitate session hijacking through cookie injection.

Impact

Exploitation of this vulnerability could result in host header injection, allowing for unauthorized redirects and session hijacking via injected cookies.

Reproduction

To reproduce this vulnerability, navigate to the password reset page of a Backdrop CMS 1.32.1 installation. Enter the username or email of a registered user and submit the form. Intercept the outgoing POST request using a tool like Burp Suite. Modify the Host header to include an attacker-controlled domain, then forward the request. The server will respond with a redirect to the malicious domain, confirming the vulnerability.