Host header injection is mitigated by preventing the tampering of Host header. It means if any request is made with tampered host header, the application responds with an error message like “404 Not Found”.Another way to pass arbitrary Host headers is to use theX-Forwarded-Hostheader. In s...
In other cases, the Host may be URL-decoded and placed directly into the email header allowing mail header injection. Using this, attackers can easily hijack accounts by BCCing password reset emails to themselves - Mozilla Persona had an issuesomewhat like this, back in alpha. Even if the ap...