A way to mitigate CVE-2017-8295

cjunior,

I dont believe this Host Header configuration object works as you believe it should, rather it is a way of telling certain protections of internal/external host names.

Anyway, another option is to create a custom attack signature perhaps? You would want to use the headercontent value to not match the actual host address.

Something like this should work:

headercontent:"Host"; nocase; re2:!"/www.example.com/"; nocase;

See if this helps,

N