GHSA-75x2-6h4m-h6mx

FullStackHero's WebAPI Boilerplate host header injection vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-26470

Packages

Ecosystem	Package	Affected	Fixed in
NuGet	FullStackHero.WebAPI.Boilerplate	>= 1.0.0, <= 1.0.1	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

A host header injection vulnerability in the forgot password function of FullStackHero's WebAPI Boilerplate v1.0.0 and v1.0.1 allows attackers to leak the password reset token via a crafted request.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-26470 advisory
https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2024-26470 web
https://github.com/fullstackhero/dotnet-webapi-boilerplate package
https://www.nuget.org/packages/FullStackHero.WebAPI.Boilerplate web