3 ms·

"Apps hosted in Azure Web Apps are not susceptible to this vulnerability."

• giancarlostoro 9y ago
  Was the first thing I was looking for, thankfully it's reasonably at the beginning of the article.
• ams6110 9y ago
  Are not now (ie already patched), or were never vulnerable?
  • Someone1234 9y ago
    Likely never, as Azure Web Apps uses a modified IIS and strongly bound bindings (e.g. *.azurewebsites.net) to work. This seems to impact only host headers delivered directly to Kestrel. There's no scenario I know of where you'd be able to do that in Azure Web Apps (since the whole thing is powered by IIS, even when .Net Core is in use).
  • breakingcups 9y ago
    Presumably the way it's proxied makes it immune by default, just as proxying through IIS without a wildcard would.