Java Web项目漏洞：检测到目标URL存在http host头攻击漏洞解决办法

最新推荐文章于 2022-12-09 10:47:05 发布

?Briella

最新推荐文章于 2022-12-09 10:47:05 发布

阅读量259

点赞数

文章标签： json java python

原文链接：https://my.oschina.net/u/3748375/blog/3048077

版权

2019独角兽企业重金招聘Python工程师标准>>>

如果此博文很幸运的帮助到了您，请问我点个赞吧(✪ω✪)谢谢

1.问题漏洞描述

2.JSP头部中有如下代码，这样的使用方法就会被漏洞检测工具查出来，认定有头攻击漏洞。

String path = request.getContextPath();
String basePath = request.getScheme()+"://"+request.getServerName()+":"+request.getServerPort()+path+"/";

3. 请求拦截上面做host合法性校验，拦截掉非法请求，首先写一个java类： web系统拦截器doFilter方法，我们在方法开始的地方做host判定，如果不在白名单内，则返回403状态码。漏洞工具收到403后认为访问请求已被终止，就不会报错了。

package com.css.apps.hostHear.action;

import java.io.File;
import java.io.IOException;
import java.io.InputStreamReader;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import com.css.apps.hostHear.util.ServerWhiteListUtil;
public class HostCleanFilter implements Filter{
	@Override
	public void doFilter(ServletRequest req, ServletResponse res,
		FilterChain chain) throws IOException, ServletException {
		// TODO Auto-generated method stub
		HttpServletRequest request = (HttpServletRequest) req;
		HttpServletResponse response = (HttpServletResponse) res;

		// 头攻击检测
		String requestHost = request.getHeader("host");
		if (requestHost != null
				&& !ServerWhiteListUtil.isWhite(requestHost)) {
			response.setStatus(403);
			response.sendError(403, "访问地址不在白名单中，无法访问！");
			return;
		}
		chain.doFilter(req, res);
	}

	@Override
	public void init(FilterConfig arg0) throws ServletException {
		// TODO Auto-generated method stub
		
	}

	@Override
	public void destroy() {
		// TODO Auto-generated method stub
		
	}

}

4.util类

package com.css.apps.hostHear.util;

import java.io.InputStreamReader;
import java.util.List;

import com.google.gson.Gson;
import com.google.gson.reflect.TypeToken;

public class ServerWhiteListUtil{
	private static List<String> whiteList = null;
	static { 
		try { 
			// 读取白名单列表
			whiteList = new Gson().fromJson( 
					new InputStreamReader(
							ServerWhiteListUtil.class.getResourceAsStream("/serverWhiteList.json")
					),new TypeToken<List<String>>() {
			}.getType()); 
			} catch (Exception e) { 
				e.printStackTrace(); 
				} 
		} 
	/** * 判断当前host是否在白名单内 *
	 *  @param host 待查host * 
	 *  @return boolean 是否在白名单内 */
	public static boolean isWhite(String host) { 
		if (whiteList == null || whiteList.size() == 0) {
			return true; 
		} 
		for (String str : whiteList) { 
			if (str != null && str.equals(host)) { 
				return true; 
			} 
		} 
		return false; 
	}
}

5.在web.xml中写入过滤器

<filter>
  <filter-name>HostCleanFilter</filter-name>
  <filter-class>com.css.apps.hostHear.action.HostCleanFilter</filter-class>
</filter>
<filter-mapping>
  <filter-name>HostCleanFilter</filter-name>
  <url-pattern>/*</url-pattern>
</filter-mapping>

6.json文件，放在哪个目录下看自己的项目结构