CVE-2025-13434: 
Homebrew vulnerability analysis and mitigation

CVE-2025-13434 is an HTTP Host Header Injection vulnerability (CWE-644) in the jameschz Hush Framework version 2.0, specifically in the file Hush\hush-lib\hush\Util.php. The vulnerability arises from the direct, unvalidated use of $_SERVER['HOST'] — a value derived from the client-supplied HTTP Host header — in generated URLs and output. It was published on November 20, 2025, with the vendor not responding to disclosure attempts. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 5.5 (Medium) (Feedly, PoC).

The root cause is classified as CWE-644 (Improper Neutralization of HTTP Headers for Scripting Syntax). At line 168 of Hush\hush-lib\hush\Util.php, the framework reads the HTTP Host header directly via if (isset($_SERVER['HOST'])) return $_SERVER['HOST']; and uses this value to construct absolute URLs, generate links (e.g., in password reset emails), or reflect it into HTML responses — all without any allowlist validation, normalization, or output encoding. An unauthenticated remote attacker can supply an arbitrary Host header in an HTTP request to influence application behavior, potentially achieving web cache poisoning, open redirects, XSS, SSRF, or token leakage via manipulated password reset links (PoC).

Successful exploitation can lead to a range of integrity-impacting outcomes without any confidentiality or availability loss. Attackers can poison web caches with attacker-controlled Host values, craft open redirects or phishing links pointing to attacker-controlled domains, inject malicious scripts via XSS when the Host value is reflected into HTML, trigger SSRF or virtual host misrouting if the Host is used in server-side requests, and manipulate password reset or account confirmation links to leak tokens. The vulnerability requires no privileges or user interaction, making it exploitable at scale against any network-accessible Hush Framework 2.0 instance (PoC, Feedly).

A public proof-of-concept exploit is available on GitHub, published by researcher lakshayyverma, and was indexed by NVD on December 11, 2025 (PoC). There is no current evidence of active in-the-wild exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.029% (0.000290), indicating a low but non-zero probability of exploitation in the near term. No threat actor attribution has been reported.

1. Reconnaissance: Identify publicly accessible web applications running the Hush Framework 2.0 by examining HTTP response headers, error pages, or source code references to hush-lib.
2. Craft malicious Host header: Prepare an HTTP request targeting any endpoint that triggers URL generation or output reflection (e.g., login, password reset, or any page that builds absolute URLs), replacing the legitimate Host header with an attacker-controlled domain (e.g., Host: attacker.com).
3. Send the request: Use a tool such as curl or Burp Suite to send the crafted request: curl -H 'Host: attacker.com' http://target-site/reset-password.
4. Achieve impact: Depending on how the application uses the Host value, the attacker can: (a) poison caches so subsequent users receive attacker-controlled URLs; (b) cause password reset emails to contain links pointing to attacker.com, leaking reset tokens; or (c) trigger XSS if the Host value is reflected unsanitized into an HTML response (PoC).

• Network: HTTP requests to the target application with anomalous or non-matching Host header values (e.g., external domains, IP addresses, or domains not associated with the server); repeated requests to password reset or account confirmation endpoints with varying Host headers.
• Logs: Web server access logs showing requests where the Host header does not match the configured server name or virtual host; unusual referrer or redirect patterns in application logs pointing to external domains.
• Application Behavior: Password reset or confirmation emails containing links to unexpected or external domains; cache entries containing URLs with attacker-controlled hostnames.

No official patch has been released by the vendor, who did not respond to the disclosure. The affected versions include all releases of Hush Framework 2.0 up to the master branch state as of November 2, 2025. Recommended mitigations include: (1) isolating or disabling affected Hush Framework instances; (2) implementing WAF rules to validate and restrict the HTTP Host header to an allowlist of expected values; (3) adding server-level configuration (e.g., Apache ServerName/ServerAlias or Nginx server_name) to reject requests with unexpected Host headers; and (4) manually patching Hush\hush-lib\hush\Util.php to validate $_SERVER['HOST'] against an allowlist before use (PoC, Feedly).