Submit #894245: ST Engineering iDirect Evolution/Velocity WebServer same 7 Host Header Injection / Open Redirect

## 1. Title

iDirect WebServer pre-auth Host header open redirect

## 2. Vulnerability Summary

- **Internal Tracking ID:** IDIRECT-WEBSERVER-HOST-REDIRECT-002
- **Vulnerability Class:** CWE-601; CWE-20
- **Vulnerability Type:** Host Header Injection / Open Redirect
- **Severity:** 6.1 (Medium)
- **CVSS 3.1 Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- **Attack Prerequisites:** Pre-authentication; victim/proxy interaction for redirect abuse
- **Verification Status:** CONFIRMED
- **Verification Evidence:** QEMU dynamic reproduction on 7 webserver builds; Host controls Location header

## 3. Affected Vendor / Product

- **Vendor:** iDirect
- **Product:** Evolution/Velocity WebServer
- **Affected Version / Firmware:** same 7 confirmed webserver samples as family report
- **Affected Component:** HTTP management service redirect to https://<Host>:443/login.html
- **Architecture:** PowerPC 32-bit MSB webserver samples

## 4. Description

iDirect WebServer 在 HTTP 访问未登录资源时，会使用请求中的 `Host` 头拼接 HTTPS 登录跳转地址：

```http
Location: https://<Host>:443/login.html
```

由于未校验 Host 是否为设备自身域名/IP，攻击者可通过伪造 Host 头控制跳转域名。该问题在当前 7 个 iDirect webserver 样本中均已动态复现。

## 5. Technical Details

- 认证要求：预认证
- 触发入口：HTTP 管理服务任意需登录路径，例如 `/api`
- 可控输入：`Host` 请求头
- 类型：Host Header Injection / Open Redirect
- 影响：钓鱼、管理域名信任绕过、反向代理场景下的跳转污染；可与前面 `success` 参数 CRLF/跳转问题组合。

## 6. Proof of Concept / Reproduction

```bash
curl -i -H 'Host: evil-host.test' 'http://<device>/api'
```

代表性响应：

```http
HTTP/1.1 302 Found
Location: https://evil-host.test:443/login.html
Connection: close
Content-Length: 0
```

## 7. Security Impact

结果文件：

```text
E:\study\项目\genefuzz\论文\FirmRec\NEW_0DAY_HUNT_20260702\idirect_host_header_family\host_header_results.csv
```

7/7 个 webserver 样本均返回 `Location: https://evil-host.test:443/login.html`。

## 8. Remediation Recommendation

- 不应直接信任 `Host` 头拼接跳转 URL。
- 使用固定配置的管理域名/IP，或仅返回相对跳转 `Location: /login.html`。
- 若必须使用 Host，需白名单校验并过滤控制字符与非法端口。

## 9. Discovery / Verification

- **Discovery Method:** manual dynamic QEMU verification after FirmRec-guided iDirect hunt
- **Submission Pack Date:** 2026-07-07
- **Source Report:** `NEW_0DAY_HUNT_20260702/IDIRECT_CONFIRMED_HOST_HEADER_REDIRECT.md`
- **Final Curation Decision:** included as confirmed / submit-ready for VulnDB.

## 10. Disclosure Timeline

| Date | Event |
| ---- | ---------------------------------- |
| TBD | Vendor notification / coordination |
| TBD | CVE/VulnDB assignment |
| TBD | Public disclosure |

## 11. Source Report / Full Original Material

> The following source content is preserved for traceability. The normalized fields above are the VulnDB form fields to submit.

## 结论

iDirect WebServer 在 HTTP 访问未登录资源时，会使用请求中的 `Host` 头拼接 HTTPS 登录跳转地址：

```http
Location: https://<Host>:443/login.html
```

由于未校验 Host 是否为设备自身域名/IP，攻击者可通过伪造 Host 头控制跳转域名。该问题在当前 7 个 iDirect webserver 样本中均已动态复现。

## PoC

```bash
curl -i -H 'Host: evil-host.test' 'http://<device>/api'
```

代表性响应：

```http
HTTP/1.1 302 Found
Location: https://evil-host.test:443/login.html
Connection: close
Content-Length: 0
```

## 已确认影响面

结果文件：

```text
E:\study\项目\genefuzz\论文\FirmRec\NEW_0DAY_HUNT_20260702\idirect_host_header_family\host_header_results.csv
```

7/7 个 webserver 样本均返回 `Location: https://evil-host.test:443/login.html`。

## 证据目录

```text
E:\study\项目\genefuzz\论文\FirmRec\NEW_0DAY_HUNT_20260702\idirect_host_header\
E:\study\项目\genefuzz\论文\FirmRec\NEW_0DAY_HUNT_20260702\idirect_host_header_family\
```

## 漏洞定性

- 认证要求：预认证
- 触发入口：HTTP 管理服务任意需登录路径，例如 `/api`
- 可控输入：`Host` 请求头
- 类型：Host Header Injection / Open Redirect
- 影响：钓鱼、管理域名信任绕过、反向代理场景下的跳转污染；可与前面 `success` 参数 CRLF/跳转问题组合。

## 修复建议

- 不应直接信任 `Host` 头拼接跳转 URL。
- 使用固定配置的管理域名/IP，或仅返回相对跳转 `Location: /login.html`。
- 若必须使用 Host，需白名单校验并过滤控制字符与非法端口。

• Source: ⚠️ https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/IDIRECT-WEBSERVER-HOST-REDIRECT-002-vulndb.md
• User: ST4R0003 (UID 99608)
• Submission: 07/17/2026 19:13 (2 months ago)
• Moderation: 09/21/2026 07:54 (2 months later)
• Status: Accepted
• VulDB entry: 408070 [ST Engineering iDirect Evolution/Velocity WebServer Evolution up to 20260717 Management Service /login.html Host redirect]
• Points: 20