3 ms·

I get where WordPress is coming from by not fixing this issue since it's an Apache thing. But since Apache's default value causes this to happen I think the fra

• wolfgang42 9y ago
  Fortunately, shared hosts aren't likely to be vulnerable to this attack: in that case, the Host header will be used to identify which shared site to run, so if an attacker changes it they'll get a different site. This vulnerability is only a problem if WordPress is installed as the default site (or has a dedicated IP address), in which case unknown values of the Host header will be passed directly to it.
• KekDemaga 9y ago
  As mentioned in a previous discussion by calibas, PHP.net has this disclaimer: "Note: Under Apache 2, you must set UseCanonicalName = On and ServerName. Otherwise, this value reflects the hostname supplied by the client, which can be spoofed. It is not safe to rely on this value in security-dependent contexts." So it seems to be clearly a Word Press issue.
• tombrossman 9y ago
  With Nginx I've always used this for the first server block to defeat host header attacks, taken from the h5bp boilerplate server configs[0]: server { listen 80 default_server; return 444; } Is something like this necessary for Apache as well? If yes, what are others using? (ignoring the non-standard but effective 444 return code) [0]https://github.com/h5bp/server-configs-nginx https://github.com/h5bp/server-configs-nginx
• TazeTSchnitzel 9y ago
  A given server can effectively have any hostname because of Host:, and that might even be desirable, so Apache's behaviour doesn't seem reasonable.