# Password reset link injection allows redirect to malicious URL

Mavenlink's password reset trusted the Host header, letting an attacker inject their domain into reset emails and steal the reset token to take over accounts.

- Payout: hidden
- Severity: high
- Program: Mavenlink
- Found by: cablej
- Disclosed: 2017-12-13
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/281575
- Library page: https://bugbountylibrary.com/r/h1%3A281575
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:high technique:source-review vuln:account-takeover vuln:host-header

**Target:** Password reset endpoint / email generation
**Root cause:** The password reset link was built using the attacker-controllable Host header instead of a fixed configured domain, so the emailed link pointed to the attacker's host.
**Steps:**
1. Trigger a password reset for the victim's email.
2. Intercept the request and modify the `Host` header to the attacker's domain.
3. The reset email is sent from Mavenlink infrastructure but contains a link to the attacker's domain.
4. Victim clicks the link; the reset token is sent to the attacker's server.
5. Attacker uses the captured token to reset the victim's password.
**How found:** Researcher observed that the password reset email link reflected the request Host header, then tested injecting an attacker-controlled host.
**Exploitation:** Attacker sends the reset request with a spoofed Host header, the victim receives a legitimate-looking email whose link points to the attacker's site; clicking it leaks the reset token to the attacker, who then resets the password and takes over the account.
**Insight:** Password reset flows that build absolute URLs from the request Host header leak reset tokens; test by spoofing Host on reset requests and checking the emailed link's domain.