Host Header injection on JBOSS EAP 7.2 (standalone.xml)

 Environment: Linux 7 & JBoss 7.2

Note: Take backup of JBoss /configuration directives.

1. Locate to standalone.xml file & check for undertow subsystem.

2. Add host-checker on host-name  tag, with corresponded to expression-filter name="host-checker" for 403 http  error code output.

<!-- hostname configurations -->

  <host name="default-host" alias="localhost">

                   <filter-ref name="host-checker"/>

  </host>

<!-- reference filters configurations -->

 <filters>

             <expression-filter name="host-checker" expression="not(equals(%{i,HOST}, www.test.int:8443)) -> response-code(403)"/>

</filters>

3. Check for below highlighted configuration.

****************************************************************

        <subsystem xmlns="urn:jboss:domain:undertow:7.0" default-server="default-server" default-virtual-host="default-host" default-servlet-container="default" default-security-domain="other">

            <buffer-cache name="default"/>

            <server name="default-server">

                <http-listener name="default" socket-binding="http" redirect-socket="https" enable-http2="true"/>

                <https-listener name="https" socket-binding="https" security-realm="ApplicationRealm" enable-http2="true"/>

                <host name="default-host" alias="localhost">

                   <filter-ref name="http-to-https" predicate="equals(%p,8084)"/>

                   <filter-ref name="host-checker"/>

                  <http-invoker security-realm="ApplicationRealm"/>

                </host>

            </server>

            <servlet-container name="default">

                <jsp-config x-powered-by="false"/>

                <session-cookie http-only="true" secure="true"/>

                <websockets/>

            </servlet-container>

            <filters>

            <rewrite name="http-to-https" target="https://www.test.int:8443%U" redirect="true"/>

                <expression-filter name="host-checker" expression="not(equals(%{i,HOST}, www.test.int:8443)) -> response-code(403)"/>

          </filters>

        </subsystem>

****************************************************************

4. Restart the JBoss server JVM.

5. To test the host-Header injection using curl command, 403 http error must be thrown.

Command:-

curl -i -s -k -X $'GET' -H $'Host: wwww.example.com' $'https://www.test.int:8443/we/services/portal'

Thanks:-)