Forum Discussion

cjunior_138458's avatar
cjunior_138458
Icon for Altostratus rankAltostratus
May 08, 2017

A way to mitigate CVE-2017-8295

Hello experts, I may be wrong in my approach, but I'm trying to mitigate CVE-2017-8295 by forcing the request to a know fixed host name, (e.g. ). So when another requested host reach my virtual server, it will be blocked preventing the attacker from receiving the password reset of the admin user in their fake domain (Return-Path).

 

The problem is that I am not able to do this with ASM, so when I'm trying to force that hostname into the list of known host names (Application Security > Headers > Host Names).

 

Is there any right way to do this? Because the ASM policy is ignoring the fake test host name even when I try to block everything related to host names (CSRF, redirection protection, etc). (Yes, the ASM isn't staging for all objects and is in blocking mode)

 

Any idea? I'll appreciate it.

 

Regards.

 

application delivery
ASM Advanced WAF
security
  • nathe's avatar
    nathe
    Icon for Cirrocumulus rankCirrocumulus
    May 08, 2017

    cjunior,

    I dont believe this Host Header configuration object works as you believe it should, rather it is a way of telling certain protections of internal/external host names.

    Anyway, another option is to create a custom attack signature perhaps? You would want to use the headercontent value to not match the actual host address.

    Something like this should work: 

    headercontent:"Host"; nocase; re2:!"/www.example.com/"; nocase;

    See if this helps,

    N