Our application has been checked by PEN Test tool, and there are description of issue:
An attacker can redirect the application using the host header on the below mentioned URL to redirect them to phishing websites.
- Make request into application
- Intercept the request using proxy tool
- Apply attack value into "Host" header
- Forward the request
- Observe the 302 response with the injected attack value
Expected behaviour: White-list all the redirect URLs. Make sure users are reminded that they are going out of domain before the redirect occurs.
So, as we use spring boot with embeded tomcat, I guess it should be some server settings.
May be someone can help with required steps for this attack preventing?