BNavin118206 (Community Member) asked a question.
Improper input handling host header in login page
The application uses the input coming from the host or x- forwarded host request headers as part of the response without proper validation.information from these headers shouid not be trusted as it is just another client side value an attacker can tamper with which can result in unintended behaviour.
They suggested recommends is given in Apache you can make SERVER-NAME trusty worthy which can be done by creating a dumy vhost that catches all requests with invalid host headers.another method under nginx is to specify a non wild-card server name and turning the usecanonicalName directive on
What should I do ,I did not understand what I added.please give me a solution .
Thank you
.png){kind=logo}
Hi @BNavin118206 (Community Member) ,
Could you provide more information about the flaw you're attempting to fix? For example, Veracode product and CWE ID?
In general, we'd recommend not relying on any hostname from the HTTP Request, even if you configure the application server (Apache / Nginx) to generate this, your application will not be able to detect if this is in place and it will be difficult to audit.
We'd recommend instead to have a local configuration file wherein you have the domain that the application should use.
Thank you,
Boy Baukema
Hi Baukema,how to configure Apache/nginx.on which file I need to change,what code can I do.i am doing some analysis about virtual host configuration for apache.but I am not understanding where and which file can I add code.
Please let me know thank you
Hi @BNavin118206 (Community Member) ,
This sounds like a 'Host header attack' flaw as reported by Acunetix ( https://www.acunetix.com/vulnerabilities/web/host-header-attack/ ).
Unfortunately, as this is not a Veracode product, I can't really say how Acunetix detects these flaws, you may want to contact their support for more guidance.
As per my last reply my recommendation would be not to use the HTTP Request Host header, but instead rely on trusted configuration.
So instead of using 'request.getRemoteHost()' you'd use something like 'environment.getProperty('host_name')" and have a key 'host_name' in your environment specific configuration files. You can read more about how this works here: https://www.baeldung.com/properties-with-spring
This is inline with the guidance given by Acunetix at: https://www.acunetix.com/vulnerabilities/web/host-header-attack/ .
Thank you,
Boy Baukema