tomcat-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Cai, Charles [COMRES/RTC/RTC]" <Charles....@Emerson.com>
Subject Question about Tomcat Virtual Host to prevent Improper-Input-Handling attack
Date Mon, 22 May 2017 18:35:09 GMT
Hi there, 

________________________________________________________________________________
Server Specs:
Server version: Apache Tomcat/7.0.54
Server built:   May 19 2014 10:26:15
Server number:  7.0.54.0
OS Name:        Windows Server 2012
OS Version:     6.2
Architecture:   amd64
JVM Version:    1.8.0_121-b13
JVM Vendor:     Oracle Corporation
________________________________________________________________________________

I'm currently on the process of trying fix a site vulnerability, basically it is one type
of the "Improper Input Handling" attack.

Let's say my website is www.mywebsite.com and there is hacker's website www.hacker.com

whenever there is a request send to www.mywebsite.com with modified "Host" header point to
www.hacker.com, my site will create a redirect to www.mywebsite.com along with whatever the
url it was. e.g.

Normal:
Host: www.mywebsite.com 
GET  www.mywebsite.com/get/some/resources/
Response 200 ok

Hack:
Host: www.hacker.com (#been manually modified) 
GET  www.mywebsite.com/get/some/resources/
Response 302 
Send another Redirect to www.hacker.com/get/some/resources 
My website is running on Tomcat 7, I tried some solution with set up the virtual host by point
the unknown host to a defaultlocalhost which supposed to do nothing. but it still send the
redirect for some reason.

Here attached is my server.xml host configure:
________________________________________________________________________________
<Engine name="Catalina" defaultHost="defaultlocalhost" jvmRoute="jvm1">  
<Host name="www.mywebsite.com"  appBase="webapps"
        unpackWARs="true" autoDeploy="false" deployOnStartup="true">

    <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
           prefix="localhost_access_log." suffix=".txt"
           pattern="%h %l %u %t &quot;%r&quot; %s %b" />
  </Host>

  <Host name="defaultlocalhost"  >
  </Host>
________________________________________________________________________________
So, my question is, Am I on the right track to prevent this kind of attack ? If yes, what
I did wrong that still not working? (The ultimate goal is, if it is not the legit Host that
been passed in, the request should be discard/ignored/return 404 but not redirect with 302)

Thank you in advance.

More references about the attack here : 
http://www.skeletonscribe.net/2013/05/practical-http-host-header-attacks.html 
http://projects.webappsec.org/w/page/13246933/Improper%20Input%20Handling 

Original Post on stackoverflow:  https://stackoverflow.com/questions/44054591/tomcat-virtual-host-to-prevent-improper-input-handling-attack


Charles Cai | Web Application Developer | RIDGID
Emerson Commercial & Residential Solutions |
Charles.Cai@emerson.com


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org


Mime
View raw message