An unauthenticated attacker can facilitate account takeover in axewater sharewarez v2.4.3 by exploiting a host header injection flaw within the password reset mechanism.

The application fails to properly validate the Host header when generating password reset links via Flask, allowing an attacker to inject a malicious domain. This manipulation tricks the system into sending password reset emails containing links that point to an attacker-controlled server.

The vulnerability presents a high risk to business operations, as it allows for unauthorized account takeover and potential compromise of sensitive user data. With a CVSS score of 7.1, this flaw is significant because it directly targets the authentication recovery workflow, which is a critical security control for ensuring user access integrity.

Immediate Action: Ensure the application configuration explicitly sets a fixed SERVER_NAME in the Flask environment to prevent the application from trusting user-supplied Host headers.

Proactive Monitoring: Review web server and application logs for anomalous requests where the Host header does not match the expected domain name.

Compensating Controls: Deploy a Web Application Firewall (WAF) to validate and filter the Host header, dropping any requests that do not conform to the expected site domain.

Public Exploit Available: Yes — a published proof-of-concept exists as documented in the provided GitHub repository and accompanying technical gist.

Given the potential for complete account takeover, administrators should verify their Flask configuration immediately to ensure host headers are not being used to construct external links. Until a vendor-supplied patch is available, strict validation of the Host header at the web server level is the most effective method to mitigate this risk.