How is an invalid host header getting set on the incoming request?

This header is set by the browser to confirm the host name and port combination it is using to communicate with the server (which often the server is not even aware of) - I see two scenarios that could lead to a spoofed header: -

1. A hacked web browser.
2. An intermediary in the call modifying the headers.

The integrity of the client is very important, there are some places such as in relation to cross original resource sharing that both the client side and the server side of the connection need to work together to handle the required checks safely.  But also in that scenario it would be saying the client is deliberately asking to be redirected to evil.com.

The second scenario was an intermediary, if an intermediary was able to modify the request message then it is likely they would also be able to modify the response message and so the client could still be redirected to evil.com.

so you basicly don't want "webapp" part of the request uri in your url?

you could just bind your application to / context.

you can do that by renaming the war to ROOT.war

or by adding jboss-web.xml with <context-root>/</context-root> to WEB-INF folder

I checked the HTTP 1.1 spec and it does look like the current behaviour that you are noticing is probably not right. The Host header usage/expecations is spread across multiple sections[1] [2] [3] of the RFC. In context of what you are noting here, the important section from that spec appears to be this[1] which states:

If Request-URI is an absoluteURI, the host is part of the Request-URI. Any Host header field value in the request MUST be ignored.

So it looks like Undertow isn't ignoring the header field in this case. swd847 might know whether this is expected or is a bug.

[1] RFC 2068 - Hypertext Transfer Protocol -- HTTP/1.1

[2] RFC 2068 - Hypertext Transfer Protocol -- HTTP/1.1

[3] RFC 2068 - Hypertext Transfer Protocol -- HTTP/1.1

If you want to do this then just setup two virtual hosts, a default one that is empty (i.e. will return 404), and a virtual host for 'localhost' that has your applications deployed. Any request with a bogus host header will end up being handled by the empty virtual host.

There is nothing we can do about this without explicit configuration (i.e. we can't guard against this in the default config, as we don't know which hosts are allowed). We could remove the default virtual host from standalone.xml and just have a host for localhost by default, but that means to use Wildfly in production you need to make configuration changes, and is very user unfriendly.

Hi Start,

Would this solutino handle Host Header Attack as explained below?

Explanation:

my jboss web server does't have domain,only use IP to access

there is a web/common directory

when access the web server use:

curl -i -H "Host: www.google.com " "http://127.0.0.1:8080/web/common/"

it goto 404 web error page

when use:

curl -i -H "Host: www.google.com " "http://127.0.0.1:8080/web/common"

return：

HTTP/1.1 302 Moved Temporarily

Location: http://www.google.com/web/common/

Transfer-Encoding: chunked

Date: Wed, 23 May 2018 14:17:46 GMT

Server: VPS

how to config jboss to prevent Location redirect

http://127.0.0.1:8080/web/common to http://www.google.com/web/common/''

Many Thanks.

Hi guys,

I know that this thread is not recent but I was struggling with your similar issue and I havent't found any solution to solve it online yet. I would like to spend few words on the way how I prevented host header injection attacks in wildfly, accepting only the requests with the right host header.

I created an undertow filter as shown in this guide https://kb.novaordis.com/index.php/Configuring_a_Custom_Undertow_Filter_in_WildFly

The filter should check the request host header. If the host header is not in the whitelist set a 400 status code, otherwise go ahead to the next httpHandler.

You may write something similar to the following snippet

@Override
public void handleRequest(HttpServerExchange exchange) throws Exception {
  HeaderValues hostHeader = requestHeaders.get("host"); 
   String host = hostHeader.getFirst();
   if ( whitelistHosts.contains(host)) {
   next.handleRequest(exchange);
  } else {
  exchange.setStatusCode(400);
  }

}

Hope this helps.

Best,

Alessio