How to remediate – HyperText Transfer Protocol (HTTP) Redirect Information

1. Introduction

The HyperText Transfer Protocol (HTTP) Redirect Information vulnerability refers to a web server redirecting requests to its root directory. This is usually an informational issue, but can indicate misconfiguration that could be exploited in some cases. Web servers are commonly affected. Impact on confidentiality, integrity and availability is typically low unless combined with other vulnerabilities.

2. Technical Explanation

The remote web server issues an HTTP redirect when a request is made to its root directory. This plugin does not denote a security problem in itself; it simply flags the presence of this behavior. An attacker could potentially exploit this if combined with other vulnerabilities, such as open redirects or predictable resource locations. There are no specific CVEs associated with this informational issue.

• Root cause: The web server is configured to redirect requests for the root directory (/).
• Exploit mechanism: An attacker could potentially use this information in conjunction with other vulnerabilities, like open redirects, to craft malicious URLs.
• Scope: Web servers running HTTP are affected.

3. Detection and Assessment

You can confirm if a system is vulnerable by checking the server’s response to requests for its root directory. A quick check involves using a web browser or command-line tool to access the base URL of the web server.

• Quick checks: Use `curl -I /` and examine the HTTP headers for redirects (e.g., Location header).
• Scanning: Nessus plugin ID 10428 can identify this behavior, but it is informational only.
• Logs and evidence: Web server access logs will show requests to the root directory and any subsequent redirects.

curl -I /

4. Solution / Remediation Steps

Analyze the redirect(s) to verify that this is valid operation for your web server and/or application.

4.1 Preparation

• Ensure you have a rollback plan in place, such as restoring from backup. A change window may be required depending on your environment and approval processes.

4.2 Implementation

1. Step 1: Review the web server’s configuration file for redirect rules related to the root directory.
2. Step 2: If redirects are intentional, verify they point to valid locations within the application.
3. Step 3: If redirects are unnecessary or point to unexpected locations, remove or modify them accordingly.

4.3 Config or Code Example

Before

Redirect / /index.html

After

# Redirect / /index.html  (commented out or removed)

4.4 Security Practices Relevant to This Vulnerability

Input validation and secure defaults are relevant practices for this vulnerability type.

• Practice 1: Input validation can prevent malicious URLs from being crafted using redirects.
• Practice 2: Secure defaults minimize the risk of misconfiguration that leads to unnecessary redirects.

4.5 Automation (Optional)

No automation is suitable for this vulnerability, as it requires manual review and analysis of web server configuration files.

5. Verification / Validation

• Post-fix check: Use `curl -I /` and confirm there is no Location header indicating a redirect.
• Re-test: Re-run the Nessus scan (plugin ID 10428) to verify it no longer reports the issue.
• Monitoring: Monitor web server access logs for unexpected redirects or errors related to URL handling.

curl -I /

6. Preventive Measures and Monitoring

Regular security baselines and policy updates can help prevent this issue. For example, a CIS control that requires secure web server configuration.

• Baselines: Update your security baseline to include checks for unnecessary redirects in web server configurations.
• Pipelines: Add checks in CI or deployment pipelines to scan for misconfigured redirect rules.
• Asset and patch process: Implement a regular review cycle for web server configurations to identify and address potential issues.

7. Risks, Side Effects, and Roll Back

• Risk or side effect 1: Removing necessary redirects could cause broken links or unexpected behavior for users.
• Roll back: Restore the web server configuration file from backup to revert the changes.

8. References and Resources

No specific references are available, as this is an informational issue.

• Vendor advisory or bulletin: Not applicable.
• NVD or CVE entry: Not applicable.
• Product or platform documentation relevant to the fix: Refer to your web server’s official documentation for configuration details.