Invenio-App vulnerable to host header injection attack

APP_ALLOWED_HOSTS not always preventing host header injection

Impact

A possible host header injection attack have been identified in Invenio-App. For an attack to be possible, all conditions below must be met:

1. Your webserver must have been configured to route all requests to your application.
2. You must have relied on APP_ALLOWED_HOSTS configuration variable to whitelist allowed host headers.
3. Flask's request.host must not have been evaluated during request handling.

An example of a view which does not evalute request.host is a simple view using just url_for to generate an external URL (similar is possible when rendering just a Jinja template):

@app.route('/')
def index():
    return url_for('index_url', _external=True)

This happens, because Werkzeug's trusted host feature, which APP_ALLOWED_HOSTS rely on, does not check the the list of trusted hosts in it's routing system that url_for is relying on.

Patches

Invenio-App v1.0.6 and v1.1.1 fully fix the issue.

Note, we strongly recommend (see Securing your instance) that you never route requests to your application with a wrong host header. The APP_ALLOWED_HOSTS configuration variable exists as an extra protective measure because it is easy to misconfigure your web server to allow requests with any host header.

Workaround 1 - Configure your webserver

You sh…