TLS/SSL protocol ensures both the confidentiatlity and integrity of the communication, and thus, a proxy without a certificate trusted by the user agent cannot insert any header.
The attack is only possible when:
- an HTTPS proxy with a certificate trusted by the user agent,
- modifies in-bound HTTP messages tricking the origin server,
- origin server didn't configure a default fall-back virtual host to handle un-recognized
Host
header values, and mishandled the modified HTTP request.
This is generally not possible in end-user browsers, as Host
is a forbidden header and JavaScript cannot set it. Host
can be altered however, using programs (curl, wget) and libraries (okhttp, libcurl) programmatically; in which case, social-engineering is needed to realize the effect of the exploit.
As mentioned in the link in the question, the some participants of the thread (see the bottom of the page) doesn't consider the impact of Host
header injection a major exploit.