# use of unsafe host header leads to open redirect

URL shortener built short links from the attacker-controlled Host header, so a crafted Host produced an rsg.ms link redirecting victims to an attacker domain.

- Payout: hidden
- Severity: low
- Program: Rockstar Games
- Found by: exception
- Disclosed: 2017-05-01
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/210875
- Library page: https://bugbountylibrary.com/r/h1%3A210875
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:low tech:php vuln:host-header vuln:open-redirect

**Target:** URL shortener endpoint /share/Person/getcontent on socialclub.rockstargames.com
**Root cause:** The shortener constructs the target URL from `$_SERVER['HTTP_HOST']` plus the request URI, so the Host header controls the destination stored in the short link.
**Steps:**
1. Log in to socialclub.rockstargames.com and post a message on your profile
2. Intercept the share request: `GET /feed/102126489/activity/2960911889698885091/share/Person/getcontent?_=1488725310707`
3. Change the Host header to `socialclub.rockstargames.com.this.is.my.domain.evil.net`
4. Read the returned short link (e.g. `http://rsg.ms/5350b75`)
5. Visit the short link; it redirects to `https://socialclub.rockstargames.com.this.is.my.domain.evil.net/member/xerojuzto/feed/2960911889698885091`
**How found:** Noticed the share button produced a short link and inspected the shortening request; hypothesized the backend builds the URL from HTTP_HOST and confirmed by injecting a Host value.
**Exploitation:** Attacker generates a short link on the trusted rsg.ms domain whose redirect target is an attacker-controlled host, then distributes it for phishing.
**Insight:** Short-link generators that echo the request URL are prime Host-header injection targets: test the share/shorten endpoint with a Host like `target.com.attacker.net` and check whether the stored redirect follows it.