BadHost

This repository is a self-contained training lab and proof-of-concept for a Starlette Host-header URL confusion vulnerability identified as X41-2026-002 / GHSA-86qp-5c8j-p5mr. It is not a weaponized exploit kit; it is a minimal reproducible lab showing how an attacker can bypass path-based authorization when application logic trusts request.url.path, while Starlette routing still uses the raw ASGI scope['path']. Repository structure: app/vulnerable_app.py contains the intentionally vulnerable Starlette application; fixed/fixed_app.py contains a mitigated version for side-by-side comparison; exploit/exploit.sh is the main PoC script; docker-compose.yml and Dockerfile build and expose both services; requirements.txt pins Starlette 0.37.2 and uvicorn 0.29.0; README.md explains the bug, exploitation flow, and mitigations. Main exploit capability: the exploit sends a normal GET request to /admin but injects URL metacharacters into the Host header, especially 'foo?' or 'foo#'. In the vulnerable app, AuthMiddleware.dispatch reads request.url.path into reconstructed_path and allows requests when that path is '/' or ''. Because request.url is reconstructed from the untrusted Host header, a request like GET /admin with Host: foo? yields a reconstructed URL similar to 'http://foo?/admin', making request.url.path parse as empty. The middleware therefore allows the request, but routing still dispatches to the /admin handler using request.scope['path']='/admin'. This results in an authorization bypass and disclosure of the demo secret FLAG{host_header_url_confusion}. Exploit behavior: exploit/exploit.sh defaults to localhost:8000, first verifies that /admin normally returns 403, then retries with crafted Host headers. It demonstrates successful bypass payloads ('Host: foo?' and 'Host: foo#') and a non-working example ('Host: foo/x'). The vulnerable admin handler returns JSON exposing the secret plus diagnostic fields: scope_path, reconstructed_url, reconstructed_path, and host_header, making the discrepancy explicit. Fixed behavior: fixed/fixed_app.py mitigates the issue in two ways: it bases authorization on request.scope['path'] instead of request.url.path, and it adds TrustedHostMiddleware with allowed hosts localhost, 127.0.0.1, and localhost:8001. As a result, malformed Host headers are rejected before application logic, and even without that middleware the auth decision would no longer be confused by URL reconstruction. Overall assessment: this is a legitimate web exploit PoC/lab for an auth bypass caused by Host-header-driven interpretation conflict. It is concise, reproducible, and intended for local training. The exploit is proof-of-concept maturity rather than operational malware: it demonstrates the vulnerability and leaks a demo flag, but does not provide persistence, code execution, or post-exploitation features.