The Ravens password reset builds the email link from the Host header in the request, so if you set X-Forwarded-Host to your site, admin link points at you, and when admin clicks it the token reaches you.
A reset page with a button that requests a link for admin and shows the link that would be emailed to him. The server builds the link host from a client-sent header.
Poison the host so admin reset link points at your site.
You poisoned the host and the link points at your site.
Why the solution worked
The server built the link from a client-controlled host, so the token can be aimed at any site. The fix is building links from a fixed host configured on the server, not from the request header.
The root cause
The link host comes from a client-controlled header. The root is trusting the Host header to build sensitive links.
How the code is fixed
Build sensitive links from a fixed, server-configured host, not the request header.
Vulnerable code
const link = `https://${req.headers['x-forwarded-host'] || req.headers.host}/reset?token=${t}`;
Safe code
const link = `https://${config.canonicalHost}/reset?token=${t}`; // fixed, server-configured host
Impact in the real world
Host-header poisoning leaks reset tokens and leads to account takeover, and has affected well-known web frameworks.
How defenders detect it
Defenders build links from a fixed host, validate the Host header against an allowlist, and alert on unexpected hosts.
