Executive brief
Snipe-IT is an open-source IT asset and license management system. A host header injection vulnerability in the password reset feature allows attackers to craft malicious password reset emails that direct users to attacker-controlled servers instead of the legitimate application. When users click these links, their password reset tokens are leaked to the attacker, enabling account takeover without needing the user's original password.
Technical details
The vulnerability is a host header injection (CWE-74) in Snipe-IT's password reset functionality. When generating password reset links, the application insufficiently validates the HTTP Host header provided in the request, allowing an attacker to inject an arbitrary host value. An attacker with network access can send a specially crafted password reset request with a malicious Host header; the application then embeds this attacker-controlled host in the reset link sent to the user's email. When the user clicks the link, they are redirected to the attacker's server, exposing the reset token in the URL. The vulnerability requires user interaction (clicking the reset link) but no prior authentication or special privileges. Patch version 5.3.8 addresses this issue; all versions from 3.0-alpha through 5.3.7 are affected.
Affected products
- Snipe Snipe-IT 3.0-alpha through 5.3.7
Timeline
- 2022-05-03: disclosed
- 2022: patched: Fixed in version 5.3.8