| tiêu đề | ST Engineering iDirect Evolution/Velocity WebServer same 7 Host Header Injection / Open Redirect |
|---|
| Mô tả | ## 1. Title
iDirect WebServer pre-auth Host header open redirect
## 2. Vulnerability Summary
- **Internal Tracking ID:** IDIRECT-WEBSERVER-HOST-REDIRECT-002
- **Vulnerability Class:** CWE-601; CWE-20
- **Vulnerability Type:** Host Header Injection / Open Redirect
- **Severity:** 6.1 (Medium)
- **CVSS 3.1 Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- **Attack Prerequisites:** Pre-authentication; victim/proxy interaction for redirect abuse
- **Verification Status:** CONFIRMED
- **Verification Evidence:** QEMU dynamic reproduction on 7 webserver builds; Host controls Location header
## 3. Affected Vendor / Product
- **Vendor:** iDirect
- **Product:** Evolution/Velocity WebServer
- **Affected Version / Firmware:** same 7 confirmed webserver samples as family report
- **Affected Component:** HTTP management service redirect to https://<Host>:443/login.html
- **Architecture:** PowerPC 32-bit MSB webserver samples
## 4. Description
iDirect WebServer 在 HTTP 访问未登录资源时，会使用请求中的 `Host` 头拼接 HTTPS 登录跳转地址：
```http
Location: https://<Host>:443/login.html
```
由于未校验 Host 是否为设备自身域名/IP，攻击者可通过伪造 Host 头控制跳转域名。该问题在当前 7 个 iDirect webserver 样本中均已动态复现。
## 5. Technical Details
- 认证要求：预认证
- 触发入口：HTTP 管理服务任意需登录路径，例如 `/api`
- 可控输入：`Host` 请求头
- 类型：Host Header Injection / Open Redirect
- 影响：钓鱼、管理域名信任绕过、反向代理场景下的跳转污染；可与前面 `success` 参数 CRLF/跳转问题组合。
## 6. Proof of Concept / Reproduction
```bash
curl -i -H 'Host: evil-host.test' 'http://<device>/api'
```
代表性响应：
```http
HTTP/1.1 302 Found
Location: https://evil-host.test:443/login.html
Connection: close
Content-Length: 0
```
## 7. Security Impact
结果文件：
```text
E:\study\项目\genefuzz\论文\FirmRec\NEW_0DAY_HUNT_20260702\idirect_host_header_family\host_header_results.csv
```
7/7 个 webserver 样本均返回 `Location: https://evil-host.test:443/login.html`。
## 8. Remediation Recommendation
- 不应直接信任 `Host` 头拼接跳转 URL。
- 使用固定配置的管理域名/IP，或仅返回相对跳转 `Location: /login.html`。
- 若必须使用 Host，需白名单校验并过滤控制字符与非法端口。
## 9. Discovery / Verification
- **Discovery Method:** manual dynamic QEMU verification after FirmRec-guided iDirect hunt
- **Submission Pack Date:** 2026-07-07
- **Source Report:** `NEW_0DAY_HUNT_20260702/IDIRECT_CONFIRMED_HOST_HEADER_REDIRECT.md`
- **Final Curation Decision:** included as confirmed / submit-ready for VulnDB.
## 10. Disclosure Timeline
| Date | Event |
| ---- | ---------------------------------- |
| TBD | Vendor notification / coordination |
| TBD | CVE/VulnDB assignment |
| TBD | Public disclosure |
## 11. Source Report / Full Original Material
> The following source content is preserved for traceability. The normalized fields above are the VulnDB form fields to submit.
## 结论
iDirect WebServer 在 HTTP 访问未登录资源时，会使用请求中的 `Host` 头拼接 HTTPS 登录跳转地址：
```http
Location: https://<Host>:443/login.html
```
由于未校验 Host 是否为设备自身域名/IP，攻击者可通过伪造 Host 头控制跳转域名。该问题在当前 7 个 iDirect webserver 样本中均已动态复现。
## PoC
```bash
curl -i -H 'Host: evil-host.test' 'http://<device>/api'
```
代表性响应：
```http
HTTP/1.1 302 Found
Location: https://evil-host.test:443/login.html
Connection: close
Content-Length: 0
```
## 已确认影响面
结果文件：
```text
E:\study\项目\genefuzz\论文\FirmRec\NEW_0DAY_HUNT_20260702\idirect_host_header_family\host_header_results.csv
```
7/7 个 webserver 样本均返回 `Location: https://evil-host.test:443/login.html`。
## 证据目录
```text
E:\study\项目\genefuzz\论文\FirmRec\NEW_0DAY_HUNT_20260702\idirect_host_header\
E:\study\项目\genefuzz\论文\FirmRec\NEW_0DAY_HUNT_20260702\idirect_host_header_family\
```
## 漏洞定性
- 认证要求：预认证
- 触发入口：HTTP 管理服务任意需登录路径，例如 `/api`
- 可控输入：`Host` 请求头
- 类型：Host Header Injection / Open Redirect
- 影响：钓鱼、管理域名信任绕过、反向代理场景下的跳转污染；可与前面 `success` 参数 CRLF/跳转问题组合。
## 修复建议
- 不应直接信任 `Host` 头拼接跳转 URL。
- 使用固定配置的管理域名/IP，或仅返回相对跳转 `Location: /login.html`。
- 若必须使用 Host，需白名单校验并过滤控制字符与非法端口。 |
|---|
| Nguồn | ⚠️ https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/IDIRECT-WEBSERVER-HOST-REDIRECT-002-vulndb.md |
|---|
| Người dùng | ST4R0003 (UID 99608) |
|---|
| Đệ trình | 17/07/2026 19:13 (cách đây 2 các tháng) |
|---|
| Kiểm duyệt | 21/09/2026 07:54 (2 months later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 408070 [ST Engineering iDirect Evolution/Velocity WebServer Evolution đến 20260717 Management Service /login.html Host Redirect] |
|---|
| điểm | 20 |
|---|