Weaknesses of type CWE-644

64 results

Neutralização inadequada de headers HTTP para sintaxe de script

A aplicação falha em sanitizar headers HTTP antes de usá-los em contextos onde código ou script pode ser interpretado, permitindo que um atacante injete comandos maliciosos. Isso ocorre quando dados do header (como User-Agent, Referer ou headers customizados) são refletidos em respostas sem validação, criando vetor para XSS ou injeção de código.

Example

Um servidor reflete o header 'X-Forwarded-For' diretamente em uma página de erro sem escapar caracteres especiais. Um atacante envia 'X-Forwarded-For: <script>alert(1)</script>' e o navegador executa o script, roubando sessão do usuário legítimo que visita a página.

How to mitigate

Valide e sanitize todos os headers HTTP antes de usá-los em respostas HTML ou contextos de execução. Use encodificação apropriada (HTML entity encoding para HTML, URL encoding para URLs) e implemente Content Security Policy (CSP) para limitar execução de scripts inline. Aplique whitelist rigorosa para headers esperados.

CVE-2025-0154MEDIUMIBM TXSeries for Multiplatforms information disclosureEPSS 0.4%CVE-2021-38997MEDIUMIBM API Connect HOST header injectionEPSS 0.4%CVE-2026-26747CRITICALA Host Header Poisoning vulnerability exists in Monica 4.1.2 due to improper handling of the HTTP Host header in app/Providers/AppServiceProEPSS 0.4%CVE-2022-22399MEDIUMIBM Aspera Faspex HTTP header injectionEPSS 0.4%CVE-2024-39736MEDIUMIBM Datacap Navigator HTTP HOST header injectionEPSS 0.4%CVE-2025-70948CRITICALA host header injection vulnerability in the mailer component of @perfood/couch-auth v0.26.0 allows attackers to obtain reset tokens and exeEPSS 0.4%CVE-2025-13803MEDIUMMediaCrush Header paths.py http headers for scripting syntaxEPSS 0.3%CVE-2026-48061MEDIUMLitestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host headerEPSS 0.3%CVE-2024-47549HIGHSharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, which may allow contamination of unintended data to HTTP reEPSS 0.3%CVE-2026-48126HIGHAlgernon: Host header path traversal in --domain mode reads files and runs Lua from parent dirEPSS 0.3%CVE-2025-52660LOWHCL AION is affected by an Host Header Injection vulnerabilityEPSS 0.3%CVE-2026-54477MEDIUMGardyn IoT Hub Improper Neutralization of HTTP Headers for Scripting SyntaxEPSS 0.3%CVE-2025-2950MEDIUMIBM i improper HTTP header neutralizationEPSS 0.3%CVE-2024-30129MEDIUMHCL Nomad server on Domino is affected by a host header injection vulnerabilityEPSS 0.3%CVE-2026-10836MEDIUMImproper neutralization of HTTP headers in Password ManagerEPSS 0.3%CVE-2026-33149HIGHTandoor Recipes Vulnerable to Host Header InjectionEPSS 0.3%CVE-2025-23001MEDIUMA Host header injection vulnerability exists in CTFd 3.7.5, due to the application failing to properly validate or sanitize the Host header.EPSS 0.3%CVE-2026-69183HIGHMonkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass)EPSS 0.3%CVE-2023-26289MEDIUMIBM Aspera Orchestrator HTTP header injectionEPSS 0.3%CVE-2023-45190MEDIUMIBM Engineering Lifecycle Optimization HTTP header injectionEPSS 0.3%