For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

cjunior_138458's avatar
cjunior_138458
Icon for Altostratus rankAltostratus
May 08, 2017

A way to mitigate CVE-2017-8295

Hello experts, I may be wrong in my approach, but I'm trying to mitigate CVE-2017-8295 by forcing the request to a know fixed host name, (e.g. ). So when another requested host reach my virtual serve...
application delivery
ASM Advanced WAF
security
nathe's avatar
nathe
Icon for Cirrocumulus rankCirrocumulus
May 08, 2017

cjunior,

I dont believe this Host Header configuration object works as you believe it should, rather it is a way of telling certain protections of internal/external host names.

Anyway, another option is to create a custom attack signature perhaps? You would want to use the headercontent value to not match the actual host address.

Something like this should work: 

headercontent:"Host"; nocase; re2:!"/www.example.com/"; nocase;

See if this helps,

N