Tomcat 6 Missing Host Header Internal IP Address Disclosure

The information leakage vulnerability may expose sensitive information about the system or Web application to attackers. Attackers can use this information to learn more about the system during unauthorized access.
 
This security problem exists in Microsoft's IIS 4.0, 5.0, and 5.1, and has been solved in IIS6. I encountered this problem for the first time in tomcat.
Details: Tomcat 6 lacks the internal IP address of the Host header.
 
Test Version: Apache Tomcat Version 6.0.35, Nov 28 2011
 
The leaked Intranet address is 10.0.0.20.

Www.2cto.com
GET/corp HTTP/1.0
 
 
HTTP/1.1 302 Moved Temporarily
 
Server: Apache-Coyote/1.1
 
Location: http: // 10.0.0.20/corp/
 
Date: Tue, 03 Jul 2012 05:49:52 GMT
 
Connection: close
Solution:
And so on.

Author akast