CVE-2020-27687 in ThingsBoard
Summary
by MITRE • 12/19/2020
ThingsBoard before v3.2 is vulnerable to Host header injection in password-reset emails. This allows an attacker to send malicious links in password-reset emails to victims, pointing to an attacker-controlled server. Lack of validation of the Host header allows this to happen.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/02/2026
The vulnerability in ThingsBoard versions prior to v3.2 represents a critical host header injection flaw that undermines the security of the password reset functionality. This weakness occurs when the application fails to properly validate or sanitize the Host header present in HTTP requests, allowing attackers to manipulate the domain portion of generated email links. The technical implementation lacks proper input validation mechanisms that should verify the legitimacy of the host header against expected domains or patterns.
This vulnerability operates at the application layer and directly impacts the integrity of authentication workflows within the platform. When users request password resets, the system generates reset links that include the Host header value to construct the complete URL. An attacker can manipulate this header value during the reset process to redirect users to malicious servers controlled by the attacker. The flaw enables the execution of various attack vectors including phishing attempts, credential harvesting, and potential account takeover scenarios.
The operational impact extends beyond simple email manipulation as it compromises user trust and system security integrity. Attackers can craft convincing password reset emails that appear legitimate while directing victims to attacker-controlled infrastructure designed to capture credentials or deliver malware. This vulnerability particularly affects organizations relying on ThingsBoard for IoT device management where compromised user accounts could lead to broader system infiltration. The attack surface is expanded because the vulnerability exists in the email generation process rather than requiring additional compromise of the application itself.
The root cause aligns with CWE-614, which addresses insecure direct object references and improper input validation in web applications. This weakness enables attackers to manipulate HTTP headers used for constructing URLs and redirects within the application context. From an ATT&CK perspective, this vulnerability maps to T1566 - Phishing and T1078 - Valid Accounts, as it facilitates both social engineering attacks through manipulated email content and potential unauthorized access through credential compromise. The vulnerability also relates to T1190 - Exploit Public-Facing Application, since it represents an exploitable entry point that can be leveraged without requiring privileged access to the system infrastructure.
Organizations should implement immediate mitigations including strict host header validation, explicit domain whitelisting for email generation processes, and proper input sanitization of HTTP headers. The recommended solution involves configuring the application to reject or normalize host headers that do not match expected domains, implementing proper URL construction mechanisms that do not rely on user-controllable header values, and updating to ThingsBoard v3.2 or later versions where this vulnerability has been addressed through enhanced input validation controls. Additionally, organizations should conduct thorough security testing of all email generation workflows and implement monitoring for anomalous host header usage patterns in their network traffic analysis systems.