Description

HCL AION is affected by a vulnerability where the application trusted the value of the HTTP Host header supplied in requests without validation. An attacker could manipulate this header to influence links, redirects or responses generated by the application, potentially resulting in unintended behavior or security impact under certain conditions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-11-06T16:18:57.633Z",
  "pubdate": "2026-11-06T16:18:57.633Z",
  "executiveSummary": "HCL AION is affected by an HTTP Host header validation vulnerability, commonly categorized under Host Header Injection. This security flaw stems from the application implicitly trusting and processing the value of the HTTP Host header supplied in client requests without performing proper input validation or domain verification.\nAn unauthenticated remote attacker can exploit this weakness by manipulating the Host header within crafted HTTP requests sent to the vulnerable application. Because HCL AION utilizes this untrusted input to construct dynamically generated links, HTTP redirects, or response body content, an attacker can directly influence the application output presented to users.\nDepending on system architecture, operational deployment, and network topology, successful exploitation of this vulnerability poses significant security risks. Primary threat vectors include password reset poisoning, web cache poisoning, open redirection, and potentially cross-site scripting (XSS) context manipulation. These risks can lead to session compromise, account takeover, or the exposure of sensitive user data, requiring prompt defensive measures to ensure proper host header validation.",
  "technicalDetails": "The technical root cause of this vulnerability lies in the unvalidated processing of the incoming HTTP Host header field within the application layer of HCL AION. Under standard HTTP protocol specifications, the Host header is a client-controlled request header that identifies the intended host server. Secure web application development standards require that server-side routing, link generation, and canonical URL construction rely on trusted internal configurations rather than raw client-supplied values. In vulnerable instances of HCL AION, the application extracts the Host header directly from incoming requests and incorporates it into backend rendering and logic flows without validating it against an explicit whitelist.\nExploitation proceeds through a step-by-step attack flow starting with request interception or manual craft. An attacker submits an HTTP request to the target HCL AION server while modifying the standard Host header to an attacker-controlled domain (e.g., replacing 'Host: legitimate-aion.com' with 'Host: attacker.com'). Upon receiving the request, the HCL AION application parses the manipulated header and generates responses using the injected host value. Consequently, absolute URLs, system-generated emails, dynamic asset references, and HTTP 3xx redirection headers constructed by the application incorporate the malicious domain.\nThis behavior enables multiple secondary post-exploitation attack vectors. In web cache poisoning scenarios, if an intermediate caching proxy caches a response generated with an injected Host header, subsequent legitimate users requesting the same resource will receive pages embedding attacker-controlled links. In password reset poisoning scenarios, if the password recovery function utilizes dynamic host generation, the application may email a victim a valid reset token pointing to the attacker's domain, allowing the attacker to capture the token upon victim interaction. Additionally, unvalidated host headers may allow attackers to bypass host-based access controls or manipulate backend proxy behavior.\nExploitation requires network access to the application's HTTP/HTTPS endpoints and can be executed without prior authentication or special user privileges. No standard payload injection (such as SQLi or command injection) is required; the attack relies entirely on HTTP request header manipulation."
}