PWaghulade508430 (Community Member) asked a question.
How to sanitize request parameters for CRLF at common place in java application. How to ignore the "Host" header provided by user in http request. to avoid host header redirection attack. I am struggling with this issue from 1 week. Thanks In advance.
If we user any malicious link as Host in request with curl then my response location is getting redirected to the malicious link. I want to send bad request as response if any malicious host is found.
Also I want to check for CRLF in Request parameters to avoid Host Splitting attack.
This both I want to implement in java application.
.png){kind=logo}
Hi @PWaghulade508430 (Community Member) ,
I'm afraid this is a very broad question that's difficult to give a specific answer to without knowing more about your specific framework.
In general there are 2 defences you can and should (both!) take to prevent a malicious Host header affecting your application:
Properties p = Properties.loadFromFile('settings.properties');
String welcomeUrl = p.getProperty("appOrigin") + "/welcome";
Alternatively, if you have multiple domains you should at least validate the incoming hostname using properties.
For CRLF characters Veracode recommends using one of our Supported Cleansing Functions: https://help.veracode.com/reader/4EKhlLSMHm5jC8P8j3XccQ/IiF_rOE79ANbwnZwreSPGA .
For example org.apache.commons.lang.StringUtils.deleteWhitespace .
When you are doing this it is a good idea to check the 'sanitized' version against the original and log a security warning if whitespace was present in a value that should not have it.
If you would like more specific guidance I would recommend you schedule a consultation call to discuss.
You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.
Thank you,
Boy Baukema
Thank You Boy. Will try this solutions.