GHSA-7gcc-r8m5-44qm: Koa has Host Header Injection via ctx.hostname
SummaryKoa's `ctx.hostname` API performs naive parsing of the HTTP Host header, extracting everything before the first colon without validating the input conforms to RFC 3986 hostname syntax. When a malformed Host header containing a `@` symbol (e.g., `evil.com:fake@legitimate.com`) is received, `ctx.hostname` returns `evil.com` - an attacker-controlled value. Applications using `ctx.hostname` for URL generation, password reset links, email verification URLs, or routing decisions are vulnerable to Host header injection attacks.DetailsThe vulnerability exists in Koa's hostname getter in `lib/request.js`:The `host` getter retrieves the raw header value with HTTP/2 and proxy support:The ProblemThe parsing logic simply splits on the first `:` and returns the first segment. There is no validation that the resulting string is a valid hostname per RFC 3986 Section 3.2.2.**RFC 3986 Section 3.2.2** defines the host component as:The `@` character is explicitly NOT permitted in the host component - it is the delimiter separating userinfo from host in the authority component.Attack VectorWhen an attacker sends:Koa parses this as:| API | Returns | Notes |
|-----|---------|-------|
| `ctx.get('Host')` | `"evil.com:fake@legitimate.com:3000"` | Raw header |
| `ctx.hostname` | `"evil.com"` | **Attacker-controlled** |
| `ctx.host` | `"evil.com:fake@legitimate.com:3000"` | Raw header value |
| `ctx.origin` | `"http://evil.com:fake@legitimate.com:3000"` | Protocol + malformed host |The `ctx.hostname` API returns `evil.com` because the parser splits on the first `:` without understanding that `evil.com:fake@legitimate.com` is a malformed authority component where `evil.com:fake` would be interpreted as userinfo by a proper URI parser.Additional Concern: `ctx.origin`Koa's `ctx.origin` property concatenates protocol and host without validation:Applications using `ctx.origin` for URL generation receive the full malformed Host header value, creating URLs with embedded credentials that browsers may interpret as userinfo.HTTP/2 ConsiderationKoa explicitly checks `httpVersionMajor >= 2` to read the `:authority` pseudo-header:The same vulnerability applies - malformed `:authority` values containing userinfo would be accepted and parsed identically.PoCSetupExploitResultThe password reset URL points to `evil.com` instead of the legitimate server. In a real attack:Attacker requests password reset for victim's email with malicious Host headerServer generates reset link using `ctx.hostname` → `https://evil.com/reset?token=SECRET`Victim receives email with poisoned linkVictim clicks link, token is sent to attacker's serverAttacker uses token to reset victim's passwordAdditional Test CasesDeployment ConsiderationFor this attack to succeed in production, the malicious Host header must reach the Koa application. This occurs when:**No reverse proxy** - Application directly exposed to internet**Misconfigured proxy** - Proxy doesn't override/validate Host header**Proxy trust enabled** (`app.proxy = true`) - `X-Forwarded-Host` can be injected**Default virtual host** - Server is the catch-all for unrecognized Host headersImpactVulnerability TypeCWE-20: Improper Input ValidationCWE-644: Improper Neutralization of HTTP Headers for Scripting SyntaxAttack Scenarios**1. Password Reset Poisoning (High Severity)**Attacker hijacks password reset tokens by poisoning reset URLsRequires victim to click link in emailResults in account takeover**2. Email Verification Bypass**Attacker poisons email verification linksCan verify attacker-controlled email on victim accounts**3. OAuth/SSO Callback Manipulation**Applications using `ctx.hostname` for OAuth redirect URIsAttacker redirects OAuth callbacks to malicious serverResults in token theft**4. Web Cache Poisoning**If responses are cached without Host in cache keyPoisoned URLs served to all usersPersistent XSS/phishing via cached responses**5. Server-Side Request Forgery (SSRF)**Internal routing decisions based on `ctx.hostname`Attacker manipulates which backend receives requestsWho Is Impacted**Direct impact**: Any Koa application using `ctx.hostname` or `ctx.origin` for URL generation without additional validation**Common patterns**: Password reset, email verification, webhook URL generation, multi-tenant routing, OAuth implementations
CVSS v3.1: 7.5