Your achievements

Level 1

0% to

Level 2

Tip /
Sign in

Sign in to Community

to gain points, level up, and earn exciting badges like the new
Bedrock Mission!

Learn more

View all

Sign in to view all badges

unable to block http options with AEM felix configuration

Avatar

Level 4

Even after adding OPTIONS method to filter methods in both Adobe Granite CSRF filter and Apache sling referrer filter, the CURL requests are still responding with 200 response.

 

curl -i -X OPTIONS http://<host>:<port>/content/*****/en/****/home.html
HTTP/1.1 200 OK
Date: Thu, 22 Oct 2020 17:42:30 GMT
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Allow: OPTIONS, TRACE, GET, HEAD
Content-Length: 0

 

is there is any other config which needs to be done to to stop HTTP OPTIONS on the direct server host:port URL, this has been raised a security vulnerability, please help us here

@Vijayalakshmi_S @Jörg_Hoh @vanegi @arunpatidar 

2 Replies

Avatar

Employee Advisor

Hi,

 

AFAIK the security checklist advises you to always have a dispatcher in front an AEM instance. And then configure this on the dispatcher/webserver. And in that case no one will have direct access to the AEM instance (except maybe admins).

Avatar

Level 4
Hi @Jörg_Hoh, we also know that this has to be blocked at apache level, but there is a security vulnerability that AEM HTTP OPTIONS opened, so we have to fix the issue

Avatar

Level 4
thanks for the reply, even after adding the method to apache sling referrer filter, we are still facing the issue. it's strange that the local host is giving 401 for me as well in publish even without adding any configurations, really confused what should be next steps here. @arunpatidar

Avatar

Community Advisor
Not sure, what could be the issueIf, if you want to block the request, create your own filter and block the request based on this 2 urls.