PT-2026-28470 · Unknown · Tandoor Recipes
Publicado
2026-03-26
·
Atualizado
2026-03-26
·
CVE-2026-33149
CVSS v3.1
8.1
Alta
| Vetor | AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Tandoor Recipes versions up to and including 2.5.3
Description
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Versions up to and including 2.5.3 set
ALLOWED HOSTS = '*' by default, which causes Django to accept any value in the HTTP Host header without validation. The application uses request.build absolute uri() to generate absolute URLs in multiple contexts, including invite link emails, API pagination, and OpenAPI schema generation. An attacker who can send requests to the application with a crafted Host header can manipulate all server-generated absolute URLs. The most critical impact is invite link poisoning: when an admin creates an invite and the application sends the invite email, the link points to the attacker's server instead of the real application. When the victim clicks the link, the invite token is sent to the attacker, who can then use it at the real application.Recommendations
Versions up to and including 2.5.3 should be updated when a patched version is available. As a temporary workaround, consider explicitly configuring the
ALLOWED HOSTS setting to a specific, trusted domain to prevent the application from accepting arbitrary Host headers.Exploit
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Tandoor Recipes