CVE-2021-45226

Vulnerability

COINS Construction Cloud version 11.12 fails to validate the HTTP Host header when generating password reset emails. The application constructs the reset link using the Host header value from the incoming request, which an attacker can control. This allows the email recipient to receive a link that points to an attacker-controlled domain instead of the legitimate service. The vulnerability is classified as Improper Input Validation (CWE-20) [1].

Exploitation

An attacker with network access to intercept or modify HTTP requests can exploit this issue. The attack sequence is simple: (1) trigger a password reset request for a user account under the attacker's control, (2) intercept the request and change the HTTP Host header to an arbitrary domain (e.g., an attacker-owned site), and (3) the application sends the password reset email with a link using that domain. No authentication or special privileges are required beyond the ability to send a reset request and modify headers [1].

Impact

Successful exploitation enables an attacker to conduct a phishing attack. Because the email originates from the trusted COINS Construction Cloud system, the victim may perceive the fraudulent reset link as legitimate and inadvertently disclose credentials or other sensitive information. The intended security mechanism of password reset via email is subverted, potentially leading to account compromise [1][2].

Mitigation

As of the public disclosure date (2022-01-13), no official fix or patch has been released by Construction Industry Solutions (COINS). The vendor was notified on 2021-11-02 but has not responded. The solution status remains open. Users of COINS Construction Cloud 11.12 are advised to monitor for security updates from the vendor and to consider implementing compensating controls, such as network-level filtering of Host headers or using a Web Application Firewall (WAF) to block unauthenticated header manipulation [1][2].