PK51068; 5.1.1.16: WebContainer response to unrecognized Expect Header
Downloadable files
Abstract
Client requests can contain an "Expect" header that includes anything, including script code to be executed by the browser that may expose the client machine to a security exposure
Download Description
PK51068 resolves the following problem:
ERROR DESCRIPTION:
XSS = Cross Site Scripting
According to section 14.20 of RFC2616:
A server that does not understand or is unable to comply with any of the expectation values in the Expect field of a request MUST respond with appropriate error status.
However, it does not state whether or not the response should include the specified value. This exposes the possibility that a request could be received that contains an Expect header containing malicious scripting code (e.g., JavaScript).
Version 5.1 WebContainer echos the unrecognized Expect Header.
LOCAL FIX:
n/a
PROBLEM SUMMARY
USERS AFFECTED:
All IBM® WebSphere® Application Server version 5.1.1.4 and later customers.
PROBLEM DESCRIPTION:
Client requests can contain an "Expect" header that includes anything, including script code to be
executed by the browser that may expose the client machine to a security exposure.
RECOMMENDATION:
None
Client requests can contain an "Expect" header that includes anything, including script code to be executed by the browser that may expose the client machine to a security exposure.
Currently, the way that the Application Server responds to this Expect header is to return the
unrecognized/unknown header back to the client. This exposes the client browser to a potential security exposure.
Application Server returns a correct status code of 417 when the Expect header does not meet the requirement; however, it also returns the original header back to the browser. This header can contain any malicious script that can potentially expose the browser to post forms that can obtain the user data.
PROBLEM CONCLUSION:
The WebContainer has been updated to block the unsupported or unrecognized original Expect header from being returned to the client.
The fix for this APAR is currently targeted for inclusion in cumulative fix 5.1.1.17.
IBM, the IBM logo and ibm.com are trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the Web at "Copyright and trademark information" at www.ibm.com/legal/copytrade.shtml.
Rate this page
Please take a moment to complete this form to help us better serve you.
