Forum Discussion
eng_mohamadawad
Nimbostratus
NimbostratusThreat :Microsoft IIS is exposed to an Internal IP Disclosure Vulnerability
Dears ;
we have the below threat by PCI on OWA , we are using F5 11.6 + hotfix 4 , please how can F5 help to close this issue :
"THREAT:
Microsoft IIS is exposed to an Internal IP Disclosur...
Kevin_Stewart
Employee
EmployeeMaybe the easiest solution is to prevent empty HTTP/1.0 Host headers from getting to IIS:
when HTTP_REQUEST {
if { [HTTP::version] eq "1.0" } {
if { not ( [HTTP::header exists Host] ) or ( [HTTP::header Host] eq "" ) } {
HTTP::header replace Host "somehost"
}
}
}