Lab: Host validation bypass via connection state attack
Summary: PortSwigger Research published a lab demonstrating a routing-based SSRF flaw in which a front-end server validates the Host header on the first request of a connection but then assumes all later requests on that same connection share that validation. The exploit sends a legitimate request followed by a request with Host set to 192.168.0.1 over a single keep-alive connection, reaching an internal admin panel at 192.168.0.1/admin and deleting the user carlos.
Why it matters: The bypass rests on a single assumption - that every request on a connection looks like the first - so a front-end that validates Host per request but not per connection can be walked straight into internal systems like the 192.168.0.1 admin panel.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026