# Don't Trust the Host Header for Sending Password Reset Emails

Mavenlink built password reset links from the client Host header; a '?' in the host bypassed subdomain validation, letting an attacker steal reset tokens and take over accounts.

- Payout: unconfirmed
- Severity: high
- Program: Mavenlink
- Credited: Jack Cable
- Disclosed: 2017-12-13
- Write-up quality: 7/10
- Original: https://lightningsecurity.io/blog/host-header-injection/
- Library page: https://bugbountylibrary.com/r/blog%3Alightningsecurity-io-blog-host-header-injection
- Tags: domain:web impact:ato kind:bounty platform:blog sev:high tech:email technique:fuzzing technique:parser-differential vuln:account-takeover vuln:host-header

**Target:** Password reset email link generation (HTTP Host header)
**Root cause:** Reset link base URL derived from client-controlled Host header; validation only checked the host ended in .mavenlink.com, and a '?' truncated the parsed host so the attacker domain became the base URL.
**Steps:**
1. Trigger password reset for victim email with `Host: example.com?.mavenlink.com`
2. Server accepts header and builds reset link as `https://example.com?.mavenlink.com/...`
3. Victim clicks link; browser resolves to `example.com` with token in query string
4. Attacker captures token and resets victim password
**How found:** Noticed Host header reflected in reset email but only subdomains of mavenlink.com accepted; hypothesized parser differential and fuzzed special characters until '?' truncated the host check.
**Exploitation:** Attacker sets Host header to `example.com?.mavenlink.com` on the password reset request; the emailed link points to attacker's domain, victim clicks, token leaks to attacker who completes reset.
**Insight:** When a Host header is validated by suffix match, try delimiter characters like '?', '#', '@', or whitespace that the URL parser treats as authority terminators to break out of the allowed suffix.