Our application has been checked by PEN Test tool, and there are description of issue:

An attacker can redirect the application using the host header on the below mentioned URL to redirect them to phishing websites.

Reproducing steps:

  1. Make request into application
  2. Intercept the request using proxy tool
  3. Apply attack value into "Host" header
  4. Forward the request
  5. Observe the 302 response with the injected attack value

Expected behaviour: White-list all the redirect URLs. Make sure users are reminded that they are going out of domain before the redirect occurs.

So, as we use spring boot with embeded tomcat, I guess it should be some server settings.

May be someone can help with required steps for this attack preventing?

  • Dmitry, what research have you done so far? Have you tried Googling this problem? Have you attempted to fix this yourself? If so, please could you give us the steps you carried out to attempt to fix it? To me, it seems like you just want us to solve this problem for you without any effort from yourself, which isn't really how this site goes. – J.J May 31 '18 at 8:39

For non-standalone Tomcat, the trick is to configure two virtual servers, where one is the default and belongs to no web application and the other one is the real one where your web application is linked with, see https://serverfault.com/q/850955

It seems that this doesn't work with Spring boot, because it seems that you cannot configure virtual servers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.