Executive brief
MediaCrush is a media hosting and sharing platform that processes user-uploaded files. A flaw in the Host header validation allows attackers to inject malicious header values, which can lead to cache poisoning, phishing link generation, and password-reset link manipulation. This could result in serving malicious content to users or redirecting them to attacker-controlled sites.
Technical details
The vulnerability is a Host header injection (CWE-644: Improper Neutralization of HTTP Headers for Scripting Syntax) in the paths.py file of MediaCrush. The application reads the HTTP Host header via request.headers["Host"].strip() without validation and uses this value in control flow decisions and URL generation (cdn_url() function and domain checks). An unauthenticated attacker can send requests with a crafted Host header to trigger generation of attacker-controlled absolute URLs, enabling cache poisoning and phishing attacks. The vulnerability is remotely exploitable with no authentication or user interaction required. No patch information is currently documented.
Affected products
- MediaCrush MediaCrush 1.0.0, 1.0.1
Timeline
- 2025-12-01: disclosed: CVE-2025-13803 published to NVD