A critical HTTP header manipulation vulnerability in JUNG Smart Visu Server allows unauthenticated attackers to conduct cache poisoning and malicious redirection attacks.

This flaw, categorized as CWE-644, occurs when the application improperly neutralizes HTTP headers. An unauthenticated attacker can inject arbitrary values into the X-Forwarded-Host header to manipulate server responses.

The ability to manipulate request URLs poses a significant risk to the integrity of the web environment. Successful exploitation can lead to cache poisoning, sophisticated phishing campaigns, and the redirection of legitimate users to attacker-controlled domains, potentially resulting in credential theft or malware delivery. With a CVSS score of 8.8, this high-severity vulnerability requires immediate attention to protect organizational assets and user trust.

Immediate Action: Contact the vendor immediately to obtain the latest security firmware or software updates for the JUNG Smart Visu Server, as a specific patch release version is not currently provided in the documentation.

Proactive Monitoring: Review web server access logs for anomalous X-Forwarded-Host values or unexpected redirection patterns that deviate from standard operating behavior.

Compensating Controls: Implement a Web Application Firewall (WAF) to inspect incoming HTTP requests and drop or sanitize requests containing unauthorized or suspicious X-Forwarded-Host header values.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced security research by Zero Science Lab.

Given the high CVSS score and the existence of a public proof-of-concept, this vulnerability presents a credible risk to the stability and security of the JUNG Smart Visu Server. Administrators should prioritize the deployment of vendor-provided updates as soon as they become available. Until an official patch is applied, ensure that WAF rules are configured to block requests that attempt to override host headers, thereby reducing the immediate attack surface.