CVE-2022-33011: 
PHP vulnerability analysis and mitigation

Known v1.3.1+2020120201 was discovered to contain a host header injection vulnerability that allows attackers to perform an account takeover via password reset poisoning (NVD, Jitendra Blog).

The vulnerability exists in the password reset functionality where the application improperly validates the Host header in password reset requests. When processing password reset requests, the application accepts arbitrary Host headers which are then used to generate password reset links sent to users. The vulnerability has a CVSS v3.1 Base Score of 8.8 HIGH (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) (NVD).

An attacker can exploit this vulnerability to take over user accounts by poisoning password reset links. When a user clicks on the manipulated password reset link, the token is sent to the attacker's controlled domain instead of the legitimate application, allowing the attacker to capture valid password reset tokens (PayloadsAllTheThings).

The vulnerability is exploitable by intercepting a password reset request and modifying the Host header to point to an attacker-controlled domain. When the victim clicks the poisoned reset link in their email, the password reset token is leaked to the attacker's domain. This attack requires user interaction in the form of clicking the malicious reset link (Pethuraj Blog).

The application should properly validate and sanitize the Host header in password reset requests to prevent header injection attacks. Additionally, the password reset functionality should be designed to only accept and process requests from legitimate application domains (Known Github).