# Host header injection to upstream URL

Server-side URL built from Host or X-Forwarded-Host without allowlist, reaching internal hosts or leaking credentials

_Area: Web infrastructure and server-side requests. Seen in 10 disclosed reports; 5 confirmed bounties, median $4,000, range $500-$33,000; latest 2025-02-12. Updated 2026-10-23._

## How it works
Code builds a server-side destination (proxy upstream, redirect fetch, OAuth token endpoint, installer payload) from the client-supplied Host header, or from X-Forwarded-Host, or from a host-validation regex that accepts attacker syntax. The assumption that Host names the server itself breaks: the request is routed or fetched to whatever host the attacker names, often carrying the server's own credentials or internal reach. Related shapes: a proxy that validates Host but routes on X-Forwarded-Host, and a frontend that routes by Host to internal-only hostnames.

## Where it shows up
- Framework helpers inheriting request Host: Rails `_url` helpers, Next.js Server Actions redirect fetch [E3](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-digging-for-ssrf-in-nextjs-apps.md)[E5](https://bugbountylibrary.com/r/h1%3A398799.md)
- Reverse proxies building upstream URL from Host or user URI without an allowlist [E1](https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-cracking-the-lens-targeting-https-hidden-attack-surface.md)
- OAuth/token-exchange controllers passing `_url` output to an HTTP client with local requests allowed [E5](https://bugbountylibrary.com/r/h1%3A398799.md)
- Shared frontends routing by Host to internal-only hostnames [E1](https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-cracking-the-lens-targeting-https-hidden-attack-surface.md)
- Signed installers fetching secondary payloads from a header-derived URL [E6](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-clearing-the-air-overblown-claims-of-vulnerabilities-exploits-severity.md)
- Proxies that validate Host but route on X-Forwarded-Host [E7](https://bugbountylibrary.com/r/h1%3A727330.md)
- Host-validation regexes that accept `#`, `@`, or userinfo delimiters [E8](https://bugbountylibrary.com/r/h1%3A1047447.md)
- URL builders using user-controlled `x-forwarded-proto` where the allowlist branch can be skipped [E4](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-exploiting-static-site-generators-when-static-is-not-actually-static.md)

## How to review
Find every server-side URL built from request data. The invariant: the destination host must come from fixed config or an explicit allowlist, never from Host, X-Forwarded-Host, or user URI segments. Grep for `_url`, `request.host`, `X-Forwarded-Host`, `x-forwarded-proto`, and HTTP-client calls fed by them. Confirm `_url` helpers are not passed to HTTP clients, proxy upstreams are pinned, and redirect fetches resolve against a trusted base. Check that auth headers are only forwarded to the intended backend [E7](https://bugbountylibrary.com/r/h1%3A727330.md). Enumerate all IPs behind a hostname, since round-robin frontends differ [E1](https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-cracking-the-lens-targeting-https-hidden-attack-surface.md).

## Variants seen
- Malformed Host and `@`-userinfo URLs tricking proxies into routing to attacker hosts [E1](https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-cracking-the-lens-targeting-https-hidden-attack-surface.md)
- Next.js relative-redirect fetch using Host for blind/full-read SSRF [E3](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-digging-for-ssrf-in-nextjs-apps.md)
- Rails OAuth token URL from Host with local requests enabled [E5](https://bugbountylibrary.com/r/h1%3A398799.md)
- Netlify IPX building fetch URL from `x-forwarded-proto`, skipping the host whitelist [E4](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-exploiting-static-site-generators-when-static-is-not-actually-static.md)
- Signed installer fetching a ClickOnce payload from a Host-derived URL [E6](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-clearing-the-air-overblown-claims-of-vulnerabilities-exploits-severity.md)
- Proxy honoring X-Forwarded-Host with `@`-suffix bypass of Host validation [E7](https://bugbountylibrary.com/r/h1%3A727330.md)
- Rails HostAuthorization leading-dot regex accepting `#`-suffixed hosts in redirect Location (redirect poisoning, not an upstream fetch) [E8](https://bugbountylibrary.com/r/h1%3A1047447.md)

## Impact and severity
Ranged from blind SSRF to internal admin panel exposure [E1](https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-cracking-the-lens-targeting-https-hidden-attack-surface.md), metadata disclosure [E7](https://bugbountylibrary.com/r/h1%3A727330.md), and attacker-staged payload fetch via a signed installer (social-engineering precondition) [E6](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-clearing-the-air-overblown-claims-of-vulnerabilities-exploits-severity.md). Severity rises when the server attaches credentials, reaches internal networks, or the flow is unauthenticated [E5](https://bugbountylibrary.com/r/h1%3A398799.md).

## Why fixes fail
Host validation that checks only Host while routing on X-Forwarded-Host is bypassed with userinfo syntax [E7](https://bugbountylibrary.com/r/h1%3A727330.md); anchored regexes built from config strings match attacker prefixes [E8](https://bugbountylibrary.com/r/h1%3A1047447.md); a whitelist that runs only in one branch is skipped when the path looks local [E4](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-exploiting-static-site-generators-when-static-is-not-actually-static.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-cracking-the-lens-targeting-https-hidden-attack-surface.md
- E2: https://bugbountylibrary.com/r/blog%3Ablog-assetnote-io-bug-bounty-2019-03-19-rce-on-mozilla-zero-day-webpagetest.md
- E3: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-digging-for-ssrf-in-nextjs-apps.md
- E4: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-exploiting-static-site-generators-when-static-is-not-actually-static.md
- E5: https://bugbountylibrary.com/r/h1%3A398799.md
- E6: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-clearing-the-air-overblown-claims-of-vulnerabilities-exploits-severity.md
- E7: https://bugbountylibrary.com/r/h1%3A727330.md
- E8: https://bugbountylibrary.com/r/h1%3A1047447.md