Summary
Invenio-App vulnerable to host header injection attack
APP_ALLOWED_HOSTS not always preventing host header injection
Workaround 1 - Configure your webserver
You should ensure that you never route requests with a wrong host header to your application. The workaround depends on which web server you are using to proxy requests to your application. In general it involves ensuring that the web server has two virtual hosts defined:
- Default virtual host: a dummy default virtual host that by default is used unless the webserver can match the host header to another virtual host (i.e. a catch-all).
- Application virtual host: the application virtual host responsible for proxing requests to the application, and configured to only reply to a whitelist of host headers.
Note, for instance in Nginx if you only configure the application virtual host, by default, it will also act as the default virtual host despite you having configured a whitelist of host headers.
Below is an example for Nginx. Note for clarity we have only included the virtual host for port 443, but this also extends to virtual hosts running on any other port.
# etc/nginx/nginx.conf
http {
# ...
include /etc/nginx/conf.d/*.conf;
}
Default virtual host
Notice, the server_name is _ and the listen directive has it marked as default_server.
# etc/nginx/conf.d/default.conf
server {
listen 443 default_server;
listen [::]:443 default_server;
server_name _;
# ...
return 301 https://www.example.com;
}
Application virtual host
Notice, the server_name is set to the host header whitelist.
# etc/nginx/conf.d/app.conf
server {
listen 443;
listen [::]:443;
server_name www.example.com;
# ...
}
Workaround 2 - Include application snippet
We strongly recommend that you use the method described in Workaround 1.
If you are not able to upgrade to the patched versions of Invenio-App, you can include the following code snippet in your application to force evaluation of request.hosts.
@app.before_request
def before_request():
request.host
For more information
If you have any questions or comments about this advisory:
- Email us at [email protected]
Impact
A possible host header injection attack have been identified in Invenio-App. For an attack to be possible, all conditions below must be met:
- Your webserver must have been configured to route all requests to your application.
- You must have relied on
APP_ALLOWED_HOSTSconfiguration variable to whitelist allowed host headers. - Flask's
request.hostmust not have been evaluated during request handling.
An example of a view which does not evalute request.host is a simple view using just url_for to generate an external URL (similar is possible when rendering just a Jinja template):
@app.route('/')
def index():
return url_for('index_url', _external=True)
This happens, because Werkzeug's trusted host feature, which APP_ALLOWED_HOSTS rely on, does not check the the list of trusted hosts in it's routing system that url_for is relying on.
CVE-2019-1020006 has a CVSS score of 6.1 (Medium). The vector is network-reachable, no privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (1.0.6, 1.1.1); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Invenio-App v1.0.6 and v1.1.1 fully fix the issue.
Note, we strongly recommend (see Securing your instance) that you never route requests to your application with a wrong host header. The APP_ALLOWED_HOSTS configuration variable exists as an extra protective measure because it is easy to misconfigure your web server to allow requests with any host header.
Frequently Asked Questions
- What is CVE-2019-1020006? CVE-2019-1020006 is a medium-severity security vulnerability in invenio-app (pip), affecting versions < 1.0.6. It is fixed in 1.0.6, 1.1.1.
- How severe is CVE-2019-1020006? CVE-2019-1020006 has a CVSS score of 6.1 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of invenio-app are affected by CVE-2019-1020006? invenio-app (pip) versions < 1.0.6 is affected.
- Is there a fix for CVE-2019-1020006? Yes. CVE-2019-1020006 is fixed in 1.0.6, 1.1.1. Upgrade to this version or later.
- Is CVE-2019-1020006 exploitable, and should I be worried? Whether CVE-2019-1020006 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2019-1020006 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2019-1020006?
- Upgrade
invenio-appto 1.0.6 or later - Upgrade
invenio-appto 1.1.1 or later
- Upgrade