Missing Host Header Verification

[smahesh]

Hi All,

This isssue is reported by the security team and they want us to fix this.

Please help me with the fix as i suspect we need to make changes on dispatcher leve.

How do we verify the Missing Host Header in aem 6.5.14

@arunpatidar ,please could you suggest on the fix.

Thanks,

Mahesh

[ksh_ingole7]

Hi @smahesh 

Can you provide more details on the issue?

Thanks,

[smahesh]

Hi @ksh_ingole7 ,

please find the details below:

It was observed that HTTP HOST header is missing verification when sending web requests. One can change the host header to access other virtual hosts on

the website such as api, solr, logs ,etc.

Affected Items

//stage-abc.com/

Observation

We observed that in the application an attacker could manually divert the code to produce the hacker’s desired output, simply by editing the host header.

Most probably web servers are configured to pass the host header to the first virtual host in the list without proper reorganisation. So It is possible to send the

HTTP requests with arbitrary host headers to the first virtual host.

As we can see it works good when the host is stage-abc.com

Thanks,

Mahesh

[Himanshu_Jain]

Can you please share the headers mentioned in dispatcher config

# first farm entry (label is not important, just for your convenience)
   /website
     {
     /clientheaders
       {
       # List of headers that are passed on
       }

[smahesh]

Hi @Himanshu_Jain 

I am posting here the list of clientheaders as asked:

"X-Forwarded-Proto"
"X-Forwarded-SSL-Certificate"
"X-Forwarded-SSL-Client-Cert"
"X-Forwarded-SSL"
"X-Forwarded-Protocol"
"CSRF-Token"
"referer"
"user-agent"
"from"
"content-type"
"content-length"
"accept-charset"
"accept-encoding"
"accept-language"
"accept"
"host"
"if-match"
"if-none-match"
"if-range"
"if-unmodified-since"
"max-forwards"
"range"
"cookie"
"depth"
"translate"
"expires"
"date"
"if"
"lock-token"
"x-expected-entity-length"
"destination"
"Sling-uploadmode"
"x-requested-with"

Please inform what else i need to add to avoid this error of Missing Host Header Verification.

Thanks,

Mahesh

[Himanshu_Jain]

Kindly refer https://experienceleague.adobe.com/docs/experience-manager-dispatcher/using/configuring/dispatcher-c...

[Peter_Puzanovs]

Hi Smahesh,

Kindly update your site webserver configuration inside rewrite rules section of your site .conf file:

RewriteCond %{HTTP_HOST} !^stage-abc.com$

RewriteRule ^(.*)$ https://stage-abc.com [R=301, L]

Regards,

Peter

[smahesh]

Hi @Peter_Puzanovs ,

Let me try the above rule, but please could you mention why this error is showing ?

Thanks,

Mahesh

[smahesh]

Hi @Peter_Puzanovs ,

I have a common rewrite file for all environment and if i add your rewrite rule for checking header then it is only for stage environment but what about dev/qa/production?

Thanks,

Mahesh 

[Himanshu_Jain]

Refer https://www.albinsblog.com/2020/10/most-important-security-headers-for-websites.html#.Y89ld3ZBy5c