CVE-2025-61132
BaseFortify
Publication date: 2025-10-23
Last updated on: 2025-10-27
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| levlaz | braindump | 0.4.14 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-620 | When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-61132 is a Host Header Injection vulnerability in levlaz braindump v0.4.14. It occurs because the application uses Flask's url_for function with _external=True to generate absolute URLs without setting a fixed SERVER_NAME. This causes Flask to rely on the Host header from incoming HTTP requests to build URLs. An attacker can manipulate this Host header to craft password reset links pointing to a domain they control, enabling them to intercept password reset tokens and potentially take over user accounts. [2]
How can this vulnerability impact me? :
This vulnerability can lead to account takeover by allowing an attacker to intercept password reset tokens. By manipulating the Host header, the attacker can send password reset links that redirect users to malicious domains, enabling the attacker to reset passwords and gain unauthorized access to user accounts. [2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring HTTP requests for unusual or manipulated Host headers, especially in password reset requests. You can capture and inspect HTTP traffic using tools like tcpdump or Wireshark to look for suspicious Host header values. For example, using tcpdump: `tcpdump -A -s 0 'tcp port 80 or tcp port 443' | grep -i Host` to filter Host headers in HTTP requests. Additionally, reviewing application logs for password reset link generation that includes unexpected domains can help detect exploitation attempts. [2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include configuring the Flask application to set a fixed SERVER_NAME value so that url_for(_external=True) generates URLs with a trusted domain, preventing Host header manipulation. Alternatively, validate and sanitize the Host header in incoming requests before using it to generate URLs. If possible, update or patch the application to a version that addresses this issue or apply custom code changes to enforce fixed domain usage in password reset links. [2]