安全漏洞之host头攻击漏洞

漏洞描述

渗透测试人员发现，抓包修改host头，在返回包中的base标签中的值会随host值改变，说明存在host头攻击漏洞。

漏洞建议

建议使用SERVER_NAME而不是host header。

脆弱性评价：

严重程度

高

中

■

低

修复过程:

web.xml:

<servlet><servlet-name>image</servlet-name><servlet-class>com.linkage.component.util.file.ImageServlet</servlet-class></servlet><servlet-mapping><servlet-name>bssframe</servlet-name><url-pattern>/portal</url-pattern></servlet-mapping><servlet-mapping><servlet-name>attach</servlet-name><url-pattern>/attach</url-pattern></servlet-mapping><servlet-mapping><servlet-name>image</servlet-name><url-pattern>/image</url-pattern></servlet-mapping><session-config><session-timeout>480</session-timeout></session-config>

ImageServlet.java:

//
// Source code recreated from a .class file by IntelliJ IDEA
// (powered by Fernflower decompiler)
//package com.linkage.component.util.file;import com.linkage.appframework.common.Common;
import com.linkage.appframework.data.IData;
import com.linkage.component.AppServlet;
import com.linkage.component.PageData;
import com.linkage.component.bean.adm.UtilBean;
import com.linkage.webframework.util.file.FileMan;
import com.linkage.webframework.util.file.ImageMan;
import java.io.IOException;
import java.io.PrintWriter;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.apache.commons.fileupload.FileItem;public class ImageServlet extends AppServlet {public static final String IMAGE_ACTION_UPLOAD = "upload";public static final String IMAGE_ACTION_VIEW = "view";public static final String IMAGE_VIEW_VALIDATE = "validate";public static final String IMAGE_VIEW_FILE = "file";protected Common common = Common.getInstance();public ImageServlet() {}public void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {try {this.servletInit(request, response);PageData pd = this.getPageData();UtilBean bean = new UtilBean();String action = pd.getParameter("action", "view");String mode;String width;if ("upload".equals(action)) {mode = pd.getParameter("IMAGE_WIDTH");width = pd.getParameter("IMAGE_HEIGHT");FileItem item = pd.getFileItem("IMAGE_PATH");IData data = bean.createFile(pd, item, "2", "1");StringBuffer src = new StringBuffer();src.append("image?file_id=" + data.get("FILE_ID"));if (!"".equals(mode)) {src.append("&width=" + mode);}if (!"".equals(width)) {src.append("&height=" + width);}StringBuffer image = new StringBuffer();image.append("<img src='" + src + "'");image.append("\t  border='" + pd.getParameter("IMAGE_BORDER") + "'");image.append("\t  hspace='" + pd.getParameter("IMAGE_HORI") + "'");image.append("\t  vspace='" + pd.getParameter("IMAGE_VERT") + "'");image.append("\t  alt='" + pd.getParameter("IMAGE_DESC") + "'");image.append("\t  align='" + pd.getParameter("IMAGE_ALIGN") + "'");image.append("/>");PrintWriter out = response.getWriter();out.println("<script language=\"javascript\"><!--");out.print("window.returnValue = \"" + image + "\"; window.close();");out.println("// --></script>");}if ("view".equals(action)) {mode = pd.getParameter("mode", "file");width = pd.getParameter("width");String height = pd.getParameter("height");String file_id;if ("validate".equals(mode)) {String query = request.getQueryString();String[] arrs = new String[]{"|", "$", "'", "'", "(", "CR", "(HOST)", "</script>", "--", "%", "LF", "(host)", "<", "script", "@", "+", "<>"};int num = 0;for(int i = 0; i < arrs.length; i++) {if (arrs[i].length() > 0 && query.indexOf(arrs[i]) > 0) {log.debug("HOST WARNING !!!--->( " + arrs[i] + " ) ");num++;}}if (num > 0) {this.common.error("您采取非法登陆方式,参数含有特殊字符,拒绝访问");}file_id = ImageMan.showValidateImage(response, Integer.parseInt(width), Integer.parseInt(height));request.getSession().setAttribute("VERIFY_CODE", file_id);String verify_code = ImageMan.showValidateImage(response, Integer.parseInt(width), Integer.parseInt(height));request.getSession().setAttribute("VERIFY_CODE", verify_code);}if ("file".equals(mode)) {file_id = pd.getParameter("file_id");String file_path = pd.getParameter("file_path");if (file_id == null) {ImageMan.showImage(response, file_path, FileMan.getFileType(file_path), width, height);} else {IData data = bean.queryFile(pd, file_id);if (data == null) {this.common.error("文件记录 " + file_id + " 不存在!");}String full_name = (String)data.get("FILE_PATH") + "/" + data.get("FILE_ID");String file_name = (String)data.get("FILE_NAME");ImageMan.showImage(response, full_name, FileMan.getFileType(file_name), width, height);}}}} catch (Exception var17) {this.servletReseted();this.setErrorInfo(var17);} finally {this.servletDetached();}}
}

home.java:

//防止host头攻击漏洞String host =pd.getRequest().getHeader("referer");log.debug("host--------->"+host);String[] arrs ={"|","$","'","\'","(","CR","(HOST)","</script>","--","%","LF","(host)","<","script","@","+","<>"};int num=0;for(int i=0;i<arrs.length;i++){if(arrs[i].length()>0 && host.indexOf(arrs[i])>0 ){log.debug("HOST WARNING !!!--->( " + arrs[i] + " ) ");num++;}}if(num>0){common.error("您采取非法登陆方式,参数含有特殊字符,拒绝访问");}

安全漏洞之host头攻击漏洞相关推荐

检测到目标URL存在http host头攻击漏洞
一.前言漏洞描述:为了方便的获得网站域名,开发人员一般依赖于HTTP Host header.例如,在php里用_SERVER["HTTP_HOST"].但是这个header是不 ...
java host头攻击漏洞_Java Web项目漏洞：检测到目标URL存在http host头攻击漏洞解决办法...
检测到目标URL存在http host头攻击漏洞详细描述为了方便的获得网站域名,开发人员一般依赖于HTTP Host header.例如,在php里用_SERVER["HTTP_HOST ...
检测到目标URL存在http host头攻击漏洞，修复方案：在Web服务器防止Host头攻击
一.前言漏洞描述:为了方便的获得网站域名,开发人员一般依赖于HTTP Host header.例如,在php里用_SERVER["HTTP_HOST"].但是这个header是不 ...
Java Web项目漏洞：检测到目标URL存在http host头攻击漏洞解决办法
2019独角兽企业重金招聘Python工程师标准>>> 如果此博文很幸运的帮助到了您,请问我点个赞吧(✪ω✪)谢谢 1.问题漏洞描述 2.JSP头部中有如下代码,这样的使用方法就会被 ...
HOST 头攻击漏洞
日期:2018-03-06 14:32:51 作者:Bay0net 0x01. 前言在一般情况下,几个网站可能会放在同一个服务器上,或者几个 web 系统共享一个服务器,host 头来指定应该由哪个 ...
检测到目标URL存在http host头攻击漏洞（中风险）
漏洞描述为了方便的获得网站域名,开发人员一般依赖于HTTP Host header.例如,在php里用_SERVER["HTTP_HOST"].但是这个header是不可信赖的, ...
URL存在http host头攻击漏洞-修复方案
[使用Nginx的修复方案] if ( $host !~* " 10.4.15.1| 10.9.4.9 " ) { return 403; } [基于tocmat的修复方 ...
绿盟扫描监测出URL存在http host 头攻击漏洞的解决方案
在tomcat(6以上版本)的server.xml配置文件中替换配置: <Host name="www.tcm.com" appBase="webapps" ...
每日漏洞 | Host头攻击
01 漏洞描述 <HTTP | HTTP报文>最后一节,简单的介绍了一下首部字段,其中就包含了Host首部字段. 为了方便获取网站域名,开发人员一般依赖于请求包中的Host首部字段.例如, ...
漏洞解决方案-Http host头攻击
漏洞解决方案-Http host头攻击漏洞概述解决方案漏洞概述为了方便的获得网站域名,开发人员一般依赖于HTTP Host header.例如,在php里用_SERVER["HTTP ...

安全漏洞之host头攻击漏洞

安全漏洞之host头攻击漏洞

安全漏洞之host头攻击漏洞相关推荐

最新文章

热门文章