Executive brief
IRRd is internet routing registry software with a web UI for managing accounts and DNS records. An attacker can manipulate HTTP headers to send password reset emails with links pointing to their own server, allowing them to intercept account recovery tokens and take over user accounts. This enables unauthorized modification of DNS records and other critical routing data.
Technical details
The vulnerability is a host header injection flaw (CWE-601, CWE-640) in IRRd's password reset, account creation, and mntner migration email generation. The web UI constructs confirmation email links from the HTTP request context without validating the Host header, allowing an attacker to inject an attacker-controlled domain. The attack requires user interaction—the victim must click the malicious email link, which passes the reset token to the attacker's server. The attacker can then use the captured token on the legitimate IRRd instance to reset the password and take over the account. Two-factor authentication provides protection against account takeover even if the token is compromised. Patches are available in versions 4.4.5 and 4.5.1.
Affected products
- IRRd IRRd 4.4.0 through 4.4.4, and 4.5.0
Timeline
- 2026-03-04: disclosed
- 2026-03-04: patched: Patched in versions 4.4.5 and 4.5.1