Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

BadHost – CVE-2026-48710: Starlette Host-Header Auth Bypass

badhost.org

Post reply on HN
Print view View original

61–65 of 65 posts

Re: BadHost – CVE-2026-48710: Starlette Host-Header Auth Bypass

#61

Post by acdha »

noirscape wrote: post #33
acdha wrote: post #29

Earlier quoted context omitted.

The saving grace here is that people are most commonly doing this for reasons other than as a defense - serving static files efficiently, combining multiple services, caching, DDoS protection, etc. There are certainly some directly exposed FastAPI instances but it’s been against the grain for decades.

Or probably the most straightforward one, which is SSL termination. Most backend software usually has very bad support for HTTPS communication, while it's typically extensively documented for something like nginx. It also catches some other strangeness like making it easier to update the certificate. The biggest risk is incorrect usage of the default_server directive, the proper way in which to handle it isn't usuall…

If I’m reading https://github.com/nginx/nginx/pull/966 right (not a given on my phone), just having Nguni in front would help because It’s now filtering the characters which make this attack possible.

Re: BadHost – CVE-2026-48710: Starlette Host-Header Auth Bypass

#63

Post by ostif-derek »

acdha wrote: post #61
noirscape wrote: post #33

Earlier quoted context omitted.

Or probably the most straightforward one, which is SSL termination. Most backend software usually has very bad support for HTTPS communication, while it's typically extensively documented for something like nginx. It also catches some other strangeness like making it easier to update the certificate. The biggest risk is incorrect usage of the default_server directive, the proper way in which to handle it isn't usuall…

If I’m reading https://github.com/nginx/nginx/pull/966 right (not a given on my phone), just having Nguni in front would help because It’s now filtering the characters which make this attack possible.

But you have to be super careful about defining the mitigations for this one, as for example Cloudflare passes malicious headers as-is without extra configuration, leaving hosts vulnerable when they are assumed to be protected.

Re: BadHost – CVE-2026-48710: Starlette Host-Header Auth Bypass

#64

Post by acdha »

ostif-derek wrote: post #63
acdha wrote: post #61

Earlier quoted context omitted.

If I’m reading https://github.com/nginx/nginx/pull/966 right (not a given on my phone), just having Nguni in front would help because It’s now filtering the characters which make this attack possible.

But you have to be super careful about defining the mitigations for this one, as for example Cloudflare passes malicious headers as-is without extra configuration, leaving hosts vulnerable when they are assumed to be protected.

Yes. you always want to test any mitigation but Cloudflare and AWS ALBs both blocked non-DNS characters in host headers with no additional configuration when I tested it. It would be surprising if Cloudflare didn’t because the Host header is how they know which customer to route a request to.
Post reply on HN