CVE-2025-23001: CTFd Host Header Injection Vulnerability

CVE-2025-23001 Overview

CVE-2025-23001 is a Host header injection vulnerability affecting CTFd version 3.7.5, an open-source Capture The Flag platform. The application fails to properly validate or sanitize the HTTP Host header in incoming requests. Attackers can manipulate the Host header to redirect users to attacker-controlled domains, enabling phishing, password reset poisoning, and web cache poisoning attacks. The vendor's stated position is that administrators must edit the NGINX configuration template to set server_name, which prevents Host header injection at the reverse proxy layer. The vulnerability is classified under [CWE-644: Improper Neutralization of HTTP Headers for Scripting Syntax].

Critical Impact
An attacker can poison password reset emails and cache entries by injecting a malicious Host header, redirecting users and credentials to attacker-controlled infrastructure.

Affected Products

CTFd version 3.7.5
CTFd deployments without a properly configured NGINX server_name directive
Self-hosted CTFd instances using the default configuration template

Discovery Timeline

2025-01-31 - CVE CVE-2025-23001 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-23001

Vulnerability Analysis

CTFd 3.7.5 trusts the Host header value supplied by the client when constructing absolute URLs. The application uses this value in outbound emails and dynamic links without validating it against an allow-list of expected hostnames. When a user requests a password reset, the resulting email contains a link built from the attacker-supplied Host header. Users who click the link submit their reset token to the attacker's server. The same primitive enables web cache poisoning when a caching layer keys entries on the URL path but stores responses containing the injected host value.

Root Cause

The root cause is missing input validation on the Host HTTP header at the application layer. CTFd relies on the deployment operator to configure the upstream NGINX reverse proxy with an explicit server_name directive, which would reject requests with unexpected Host values. In default installations where this hardening step is skipped, arbitrary values flow into URL generation logic. This is a classic instance of [CWE-644], where header content influences server-side behavior without neutralization.

Attack Vector

Exploitation requires an attacker to send an HTTP request with a crafted Host header and user interaction to click a resulting link. The attacker typically triggers a password reset for a target account while supplying a malicious Host header such as attacker.example.com. CTFd generates a reset email containing a URL like https://attacker.example.com/reset_password/<token>. When the victim clicks the link, the reset token is delivered to the attacker, enabling account takeover. Cache poisoning variants abuse the same injection to serve rewritten resources to other users of the same cache.

No verified exploit code is publicly indexed for this CVE. A proof-of-concept walkthrough is described at the CodeToAnBug CVE-2025-23001 PoC.

Detection Methods for CVE-2025-23001

Indicators of Compromise

Outbound password reset emails referencing hostnames that do not match the canonical CTFd domain
HTTP requests in web server logs containing Host header values that differ from the deployed server_name
Unexpected spikes in password reset requests followed by successful logins from new IP addresses
Cached responses returning links pointing to external or unknown hostnames

Detection Strategies

Parse reverse proxy and application logs for the Host header field and alert when values fall outside an allow-list of approved domains
Correlate password reset request events with the Host value used at generation time to identify poisoned reset flows
Monitor email gateway logs for outbound CTFd notifications containing non-canonical URLs

Monitoring Recommendations

Enable verbose access logging on the NGINX or reverse proxy layer to capture full Host header values for every request
Forward CTFd application logs and reverse proxy logs to a centralized SIEM for retention and correlation
Establish a baseline of legitimate Host values and alert on deviations in near real time

How to Mitigate CVE-2025-23001

Immediate Actions Required

Edit the NGINX configuration template shipped with CTFd and set the server_name directive to the canonical hostname of the deployment
Add a default server block that returns HTTP 444 or 421 for requests with unexpected Host headers
Upgrade to the latest CTFd release referenced in the CTFd Blog Update
Rotate any password reset tokens issued during the exposure window and force affected users to re-authenticate

Patch Information

Refer to the CTFd Blog Update for release notes covering version 3.7.6 and later. Source and commit history are available in the GitHub CTFd Repository. The vendor position is that operators must configure server_name in the NGINX template as part of a hardened deployment.

Workarounds

Configure the upstream reverse proxy with a strict server_name allow-list to drop or reject requests with unexpected Host values
Place CTFd behind a web application firewall with a rule that validates Host headers against approved domains
Restrict password reset email generation to use a hardcoded base URL rather than deriving it from request headers

bash

# NGINX server_name hardening example
server {
    listen 80 default_server;
    server_name _;
    return 444;
}

server {
    listen 80;
    server_name ctf.example.com;

    location / {
        proxy_pass http://ctfd_upstream;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Host $host;
    }
}