CVE-2022-33011

Vulnerability

Overview

CVE-2022-33011 affects Known (formerly Idno), a social publishing platform, version v1.3.1+2020120201 and possibly earlier versions. The vulnerability is a host header injection that allows an attacker to manipulate the Host header in a password reset request. Because the application uses the Host header to construct the password reset link sent via email, an attacker can replace the legitimate host with an attacker-controlled domain. This leads to password reset poisoning, a well-known technique detailed in reference [2] where the victim follows a malicious link and unknowingly reveals their reset token to the attacker.

Exploitation

Prerequisites and Attack Surface

No authentication is required to trigger the password reset function. The attacker only needs to know the victim's email address or username associated with the account. The attack is performed by intercepting the password reset request (e.g., via a proxy like Burp Suite) and replacing the Host header with an attacker-controlled domain before forwarding the request to the server [2]. The server then generates a password reset email containing a link that points to the attacker's domain, complete with the legitimate reset token in the URL. The victim, upon clicking the link, visits the attacker's site and the token is captured.

Impact

A successful exploit allows the attacker to obtain a valid password reset token for the victim's account. With this token, the attacker can reset the victim's password and gain full control of the account—an account takeover [1][4]. The impact is critical as it compromises user data, identity, and any privileges associated with the account.

Mitigation

Status

As of the publication date (2022-07-08), the advisory confirms the vulnerability exists in the stated version. The vendor's repository (GitHub) is the primary source for fixes [1]. Users should ensure they are running a patched version of Known. No official workaround is documented in the references, but limiting the use of the Host header for generating links and validating it against a whitelist of allowed hosts are standard hardening measures [4]. This CVE is not listed in CISA's Known Exploited Vulnerabilities Catalog as of this writing.