Description
In many cases, developers are trusting the HTTP Host header value and using it to generate links, import scripts and even generate password resets links with its value. This is a very bad idea, because the HTTP Host header can be controlled by an attacker. This can be exploited using web-cache poisoning and by abusing alternative channels like password reset emails.
Remediation
The web application should use the SERVER_NAME instead of the Host header. It should also create a dummy vhost that catches all requests with unrecognized Host headers. This can also be done under Nginx by specifying a non-wildcard SERVER_NAME, and under Apache by using a non-wildcard serverName and turning the UseCanonicalName directive on. Consult references for detailed information.
References
Related Vulnerabilities
Perl Improper Input Validation Vulnerability (CVE-2010-4777)
MySQL Improper Input Validation Vulnerability (CVE-2017-3256)
Django Improper Input Validation Vulnerability (CVE-2012-4520)
WordPress Plugin SI CAPTCHA Anti-Spam Serving Spam (3.0.2)
Moodle Improper Input Validation Vulnerability (CVE-2013-2083)