Description
In many cases, developers are trusting the HTTP Host header value and using it to generate links, import scripts and even generate password resets links with its value. This is a very bad idea, because the HTTP Host header can be controlled by an attacker. This can be exploited using web-cache poisoning and by abusing alternative channels like password reset emails.
Remediation
The web application should use the SERVER_NAME instead of the Host header. It should also create a dummy vhost that catches all requests with unrecognized Host headers. This can also be done under Nginx by specifying a non-wildcard SERVER_NAME, and under Apache by using a non-wildcard serverName and turning the UseCanonicalName directive on. Consult references for detailed information.
References
Related Vulnerabilities
File Upload Functionality Detected
OpenSSL Improper Input Validation Vulnerability (CVE-2010-0740)
Oracle HTTP Server Improper Input Validation Vulnerability (CVE-2020-29508)
WordPress Improper Input Validation Vulnerability (CVE-2008-2392)
Ruby on Rails Improper Input Validation Vulnerability (CVE-2011-2929)