You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Anushka sur <an...@gmail.com> on 2026/07/15 09:10:41 UTC
Tomcat host header redirect issue
We have identified a VAPT issue in our Oracle APEX application deployed on
ORDS 24.1.11 running on Apache Tomcat 9.0.11.
Observed behavior:
When the application URL host is replaced with another value, the
application redirects using that modified host instead of keeping the
redirect restricted to the approved domain. For example, if the original
host is replaced, the response follows the changed host value.
For example, when the application is accessed using sdcoradb5.com:8083, and
the host value is replaced with bing.com, the application redirects using
the modified host value instead of the approved application domain.
This indicates that the request host may be getting trusted in the Tomcat
layer, which can lead to a host header injection or unvalidated redirect
issue.
Oracle support has advised that this needs to be checked at the Tomcat
layer, so we are requesting your help to review the configuration and
identify the root cause.
Expected behavior:
The application should only redirect to the approved application domain and
should ignore or reject unexpected host values.
Please investigate and suggest the required configuration or remediation
steps.
Re: Tomcat host header redirect issue
Posted by Johan Compagner <jc...@servoy.com>.
I guess these are the test:
curl https://tomcat.apache.org<https://tomcat.apache.org/>
If you do that then you get the normal home page
But if you do this:
curl -H "Host: bing.com" https://tomcat.apache.org<https://tomcat.apache.org/>
You get:
Requested host does not match any Subject Alternative Names (SANs) on TLS certificate [cfa0deb905f8070b97e4b80fad764e4406e3f683af1bdc71809112e39a6cf458] in use with this connection.
Visit https://www.fastly.com/documentation/guides/concepts/errors/#routing-errors for more information.
If you do this with google:
curl -H "Host: www.bing.com" https://www.google.com<https://www.google.com/>
You get some error page i think
If you hit a cloudfare backed website:
curl -H "Host: www.bing.com" https://www.servoy.com<https://www.servoy.com/>
<html>
<head><title>403 Forbidden</title></head>
<body>
<center><h1>403 Forbidden</h1></center>
<hr><center>cloudflare</center>
</body>
</html>
Its already intercepted by cloudfare
So it is always quite different then what you get, but you will almost never get the actual page..
________________________________
Van: Christopher Schultz <ch...@christopherschultz.net>
Verzonden: woensdag 22 juli 2026 21:17
Aan: users@tomcat.apache.org <us...@tomcat.apache.org>
Onderwerp: Re: Tomcat host header redirect issue
Anushka,
On 7/21/26 6:15 AM, Anushka sur wrote:
> As you suggested, we created a dedicated virtual host in the |
> server.xml| file. However, even after adding the virtual host
> configuration, the issue still persists.
>
> For example, when we access the application using:
>
> |https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsdcoradb5.hdfc.com%3A8083%2FORDS&data=05%7C02%7Cjcompagner%40servoy.com%7C8ff2ae0ec22c480facd108dee825ddd0%7C057cbaf335604bfd8935be6a76c7d87b%7C1%7C0%7C639203446493271686%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=qLdOR5mwP%2BFY0rDz2z2Q05NX%2Bk8GPbRvMeCRf74ZkYc%3D&reserved=0 <https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsdcoradb5.hdfc.com%3A8083%2F&data=05%7C02%7Cjcompagner%40servoy.com%7C8ff2ae0ec22c480facd108dee825ddd0%7C057cbaf335604bfd8935be6a76c7d87b%7C1%7C0%7C639203446493300338%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=x6VVzEBswZCiBJjYXJ9Wyl0enGb7ZBbY2oITpfzbXCc%3D&reserved=0
> ORDS>|
Can you be very clear about what you mean, here?
If you make a request to sdcoradb5.hdfc.com:8083 using e.g. curl,
presumably you will get a response from your application.
If you make a request to bing.com using e.g. curl, then it will
obviously contact Bing and not go to your application at all.
Where does the "redirect" come into the picture? Note that "redirect"
has a very specific meaning in the context of HTTP / web applications.
-chris
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Tomcat host header redirect issue
Posted by Mark Thomas <ma...@apache.org>.
On 30/07/2026 13:43, Anushka sur wrote:
> Hi Christopher,
>
> Have pasted the whole server.xml file
If you aren't going to bother following the advice you have been given
more than a week ago, there isn't much point you asking here for help.
https://lists.apache.org/thread/v1o3zdprpcry19zny2oqqj9nocj8vnp2
You need *TWO* Host elements.
You only have a single certificate, so the TLS configuration won't be an
issue here.
Mark
>
>
> <?xml version="1.0" encoding="UTF-8"?>
> <Server port="8005" shutdown="SHUTDOWN">
>
> <Listener className="org.apache.catalina.startup.VersionLoggerListener" />
> <Listener className="org.apache.catalina.core.AprLifecycleListener"
> SSLEngine="on" />
> <Listener
> className="org.apache.catalina.core.JreMemoryLeakPreventionListener" />
> <Listener
> className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />
> <Listener
> className="org.apache.catalina.core.ThreadLocalLeakPreventionListener" />
>
> <!-- Application Context (sanitized path) -->
> <Context path="/app/context" docBase="app_folder" reloadable="true" />
>
> <GlobalNamingResources>
> <Resource
> name="UserDatabase"
> auth="Container"
> type="org.apache.catalina.UserDatabase"
> description="User database"
> factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
> pathname="conf/tomcat-users.xml" />
> </GlobalNamingResources>
>
> <Service name="Catalina">
>
> <!-- SSL Connector (all sensitive info masked) -->
> <Connector
> protocol="org.apache.coyote.http11.Http11NioProtocol"
> port="8083"
> connectionTimeout="20000"
> maxThreads="200"
> scheme="https"
> secure="true"
> SSLEnabled="true"
> keystoreFile="/***/***/sanitized_cert.pfx"
> keystorePass="********"
> keystoreType="PKCS12"
> clientAuth="false"
> sslProtocol="TLS" />
>
> <Engine name="Catalina" defaultHost="localhost">
>
> <Realm className="org.apache.catalina.realm.LockOutRealm">
> <Realm
> className="org.apache.catalina.realm.UserDatabaseRealm"
> resourceName="UserDatabase" />
> </Realm>
>
> <Host
> name="localhost"
> appBase="webapps"
> unpackWARs="true"
> autoDeploy="true">
>
> <Valve
> className="org.apache.catalina.valves.AccessLogValve"
> directory="logs"
> prefix="localhost_access_log"
> suffix=".txt"
> pattern="%h %l %u %t "%r" %s %b" />
>
> </Host>
>
> </Engine>
> </Service>
> </Server>
>
> On Wed, 29 Jul, 2026, 19:33 Christopher Schultz, <
> chris@christopherschultz.net> wrote:
>
>> Anushka,
>>
>> On 7/23/26 2:03 AM, Anushka sur wrote:
>>> We tested by intercepting the request to
>>> https://sdcoradb5.hdfc.com:8083/ORDS and modifying only the HTTP Host
>>> header to bing.com while sending the request to the same Tomcat server.
>> The
>>> application still processed the request instead of rejecting it with a
>> 4xx
>>> response.
>>
>> Please post your <Engine> element and *all* <Host> elements from your
>> server.xml file. Also, all <Connector> elements.
>>
>> In fact, post the whole file, redacting any specific values that contain
>> sensitive information.
>>
>> -chris
>>
>>> On Thu, 23 Jul, 2026, 00:47 Christopher Schultz, <
>>> chris@christopherschultz.net> wrote:
>>>
>>>> Anushka,
>>>>
>>>> On 7/21/26 6:15 AM, Anushka sur wrote:
>>>>> As you suggested, we created a dedicated virtual host in the |
>>>>> server.xml| file. However, even after adding the virtual host
>>>>> configuration, the issue still persists.
>>>>>
>>>>> For example, when we access the application using:
>>>>>
>>>>> |https://sdcoradb5.hdfc.com:8083/ORDS <
>> https://sdcoradb5.hdfc.com:8083/
>>>>> ORDS>|
>>>>
>>>> Can you be very clear about what you mean, here?
>>>>
>>>> If you make a request to sdcoradb5.hdfc.com:8083 using e.g. curl,
>>>> presumably you will get a response from your application.
>>>>
>>>> If you make a request to bing.com using e.g. curl, then it will
>>>> obviously contact Bing and not go to your application at all.
>>>>
>>>> Where does the "redirect" come into the picture? Note that "redirect"
>>>> has a very specific meaning in the context of HTTP / web applications.
>>>>
>>>> -chris
>>>>
>>>>
>>>> ---------------------------------------------------------------------
>>>> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
>>>> For additional commands, e-mail: users-help@tomcat.apache.org
>>>>
>>>>
>>>
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
>> For additional commands, e-mail: users-help@tomcat.apache.org
>>
>>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Tomcat host header redirect issue
Posted by Anushka sur <an...@gmail.com>.
Hi Christopher,
Have pasted the whole server.xml file
<?xml version="1.0" encoding="UTF-8"?>
<Server port="8005" shutdown="SHUTDOWN">
<Listener className="org.apache.catalina.startup.VersionLoggerListener" />
<Listener className="org.apache.catalina.core.AprLifecycleListener"
SSLEngine="on" />
<Listener
className="org.apache.catalina.core.JreMemoryLeakPreventionListener" />
<Listener
className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />
<Listener
className="org.apache.catalina.core.ThreadLocalLeakPreventionListener" />
<!-- Application Context (sanitized path) -->
<Context path="/app/context" docBase="app_folder" reloadable="true" />
<GlobalNamingResources>
<Resource
name="UserDatabase"
auth="Container"
type="org.apache.catalina.UserDatabase"
description="User database"
factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
pathname="conf/tomcat-users.xml" />
</GlobalNamingResources>
<Service name="Catalina">
<!-- SSL Connector (all sensitive info masked) -->
<Connector
protocol="org.apache.coyote.http11.Http11NioProtocol"
port="8083"
connectionTimeout="20000"
maxThreads="200"
scheme="https"
secure="true"
SSLEnabled="true"
keystoreFile="/***/***/sanitized_cert.pfx"
keystorePass="********"
keystoreType="PKCS12"
clientAuth="false"
sslProtocol="TLS" />
<Engine name="Catalina" defaultHost="localhost">
<Realm className="org.apache.catalina.realm.LockOutRealm">
<Realm
className="org.apache.catalina.realm.UserDatabaseRealm"
resourceName="UserDatabase" />
</Realm>
<Host
name="localhost"
appBase="webapps"
unpackWARs="true"
autoDeploy="true">
<Valve
className="org.apache.catalina.valves.AccessLogValve"
directory="logs"
prefix="localhost_access_log"
suffix=".txt"
pattern="%h %l %u %t "%r" %s %b" />
</Host>
</Engine>
</Service>
</Server>
On Wed, 29 Jul, 2026, 19:33 Christopher Schultz, <
chris@christopherschultz.net> wrote:
> Anushka,
>
> On 7/23/26 2:03 AM, Anushka sur wrote:
> > We tested by intercepting the request to
> > https://sdcoradb5.hdfc.com:8083/ORDS and modifying only the HTTP Host
> > header to bing.com while sending the request to the same Tomcat server.
> The
> > application still processed the request instead of rejecting it with a
> 4xx
> > response.
>
> Please post your <Engine> element and *all* <Host> elements from your
> server.xml file. Also, all <Connector> elements.
>
> In fact, post the whole file, redacting any specific values that contain
> sensitive information.
>
> -chris
>
> > On Thu, 23 Jul, 2026, 00:47 Christopher Schultz, <
> > chris@christopherschultz.net> wrote:
> >
> >> Anushka,
> >>
> >> On 7/21/26 6:15 AM, Anushka sur wrote:
> >>> As you suggested, we created a dedicated virtual host in the |
> >>> server.xml| file. However, even after adding the virtual host
> >>> configuration, the issue still persists.
> >>>
> >>> For example, when we access the application using:
> >>>
> >>> |https://sdcoradb5.hdfc.com:8083/ORDS <
> https://sdcoradb5.hdfc.com:8083/
> >>> ORDS>|
> >>
> >> Can you be very clear about what you mean, here?
> >>
> >> If you make a request to sdcoradb5.hdfc.com:8083 using e.g. curl,
> >> presumably you will get a response from your application.
> >>
> >> If you make a request to bing.com using e.g. curl, then it will
> >> obviously contact Bing and not go to your application at all.
> >>
> >> Where does the "redirect" come into the picture? Note that "redirect"
> >> has a very specific meaning in the context of HTTP / web applications.
> >>
> >> -chris
> >>
> >>
> >> ---------------------------------------------------------------------
> >> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> >> For additional commands, e-mail: users-help@tomcat.apache.org
> >>
> >>
> >
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
Re: Tomcat host header redirect issue
Posted by Christopher Schultz <ch...@christopherschultz.net>.
Anushka,
On 7/23/26 2:03 AM, Anushka sur wrote:
> We tested by intercepting the request to
> https://sdcoradb5.hdfc.com:8083/ORDS and modifying only the HTTP Host
> header to bing.com while sending the request to the same Tomcat server. The
> application still processed the request instead of rejecting it with a 4xx
> response.
Please post your <Engine> element and *all* <Host> elements from your
server.xml file. Also, all <Connector> elements.
In fact, post the whole file, redacting any specific values that contain
sensitive information.
-chris
> On Thu, 23 Jul, 2026, 00:47 Christopher Schultz, <
> chris@christopherschultz.net> wrote:
>
>> Anushka,
>>
>> On 7/21/26 6:15 AM, Anushka sur wrote:
>>> As you suggested, we created a dedicated virtual host in the |
>>> server.xml| file. However, even after adding the virtual host
>>> configuration, the issue still persists.
>>>
>>> For example, when we access the application using:
>>>
>>> |https://sdcoradb5.hdfc.com:8083/ORDS <https://sdcoradb5.hdfc.com:8083/
>>> ORDS>|
>>
>> Can you be very clear about what you mean, here?
>>
>> If you make a request to sdcoradb5.hdfc.com:8083 using e.g. curl,
>> presumably you will get a response from your application.
>>
>> If you make a request to bing.com using e.g. curl, then it will
>> obviously contact Bing and not go to your application at all.
>>
>> Where does the "redirect" come into the picture? Note that "redirect"
>> has a very specific meaning in the context of HTTP / web applications.
>>
>> -chris
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
>> For additional commands, e-mail: users-help@tomcat.apache.org
>>
>>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Tomcat host header redirect issue
Posted by Anushka sur <an...@gmail.com>.
Hi Christopher,
We tested by intercepting the request to
https://sdcoradb5.hdfc.com:8083/ORDS and modifying only the HTTP Host
header to bing.com while sending the request to the same Tomcat server. The
application still processed the request instead of rejecting it with a 4xx
response.
On Thu, 23 Jul, 2026, 00:47 Christopher Schultz, <
chris@christopherschultz.net> wrote:
> Anushka,
>
> On 7/21/26 6:15 AM, Anushka sur wrote:
> > As you suggested, we created a dedicated virtual host in the |
> > server.xml| file. However, even after adding the virtual host
> > configuration, the issue still persists.
> >
> > For example, when we access the application using:
> >
> > |https://sdcoradb5.hdfc.com:8083/ORDS <https://sdcoradb5.hdfc.com:8083/
> > ORDS>|
>
> Can you be very clear about what you mean, here?
>
> If you make a request to sdcoradb5.hdfc.com:8083 using e.g. curl,
> presumably you will get a response from your application.
>
> If you make a request to bing.com using e.g. curl, then it will
> obviously contact Bing and not go to your application at all.
>
> Where does the "redirect" come into the picture? Note that "redirect"
> has a very specific meaning in the context of HTTP / web applications.
>
> -chris
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
Re: Tomcat host header redirect issue
Posted by Christopher Schultz <ch...@christopherschultz.net>.
Anushka,
On 7/21/26 6:15 AM, Anushka sur wrote:
> As you suggested, we created a dedicated virtual host in the |
> server.xml| file. However, even after adding the virtual host
> configuration, the issue still persists.
>
> For example, when we access the application using:
>
> |https://sdcoradb5.hdfc.com:8083/ORDS <https://sdcoradb5.hdfc.com:8083/
> ORDS>|
Can you be very clear about what you mean, here?
If you make a request to sdcoradb5.hdfc.com:8083 using e.g. curl,
presumably you will get a response from your application.
If you make a request to bing.com using e.g. curl, then it will
obviously contact Bing and not go to your application at all.
Where does the "redirect" come into the picture? Note that "redirect"
has a very specific meaning in the context of HTTP / web applications.
-chris
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Tomcat host header redirect issue
Posted by Mark Thomas <ma...@apache.org>.
On 06/08/2026 07:50, Anushka sur wrote:
> Hi Mark,
> Thank you for your response, and I apologize for the delay.
> We were in a change freeze period at the bank, so we were unable to make
> any configuration changes during that time.
>
> We have implemented the first recommendation by creating the required
> virtual host for our application. However, we are currently struggling to
> understand the second recommendation regarding configuring the default host
> with a ROOT application that returns a 4xx response.
>
> We are relatively new to Tomcat administration, and our application is an
> Oracle APEX application.
>
> Because of that, we are not sure how to create or configure the ROOT
> application for the default host.
Do you know how to write a simple servlet that returns 4xx for
everything, add the servlet to a web application and deploy that web
application to Tomcat?
> Could you please provide some guidance or point us to an example of how
> this should be configured in a Tomcat + Oracle APEX environment?
There is nothing Oracle specific about this configuration. It is a
standard virtual host configuration with ORDS in one host (for the APEX
app) and a simple application in the default host that rejects everything.
This might help explain the previous sample configuration I provided:
https://nightlies.apache.org/tomcat/tomcat-11.0.x/docs/virtual-hosting-howto.html
Mark
>
> We appreciate your patience and any assistance you can provide.
>
> On Sun, 2 Aug, 2026, 12:13 GUSTAVO AVITABILE, <av...@unina.it> wrote:
>
>>
>>
>>
>> ________________________________________
>> From: GUSTAVO AVITABILE <av...@unina.it>
>> Sent: Friday, July 24, 2026 3:57 PM
>> To: Tomcat Users List
>> Subject: Re: Tomcat host header redirect issue
>>
>> Hi Team,
>>
>>
>> ________________________________________
>> From: Mark Thomas <ma...@apache.org>
>> Sent: Thursday, July 23, 2026 3:14 PM
>> To: users@tomcat.apache.org
>> Subject: Re: Tomcat host header redirect issue
>>
>> On 23/07/2026 09:15, Anushka sur wrote:
>>> Hi Mark,
>>>
>>> 1.It is https
>>
>> OK.
>>
>>> These is the settings for server.xml
>>
>> No, those are part of the settings from server.xml. Since you are using
>> HTTPS then all of the Connector elements are relevant as well.
>>
>> I did ask for the contents of server.xml, not part of it.
>>
>>> 2.
>>
>> I'm surprised that even started.
>>
>> To repeat what I said previously:
>>
>> Set up one virtual host for the correct host name(s) and deploy your
>> application to that host.
>>
>> Set up the default host with a ROOT that returns a 4xx response to all
>> requests.
>>
>> That means you need TWO host elements. You only have one. And a
>> reference to a default host that doesn't exist.
>>
>> The basics are:
>>
>> <Engine name="Catalina" defaultHost="other">
>> <Host name="other" appBase="webapps-other" />
>> <Host name="hblacsuat.hdfcbankuat.com" appBase="webapps" />
>> </Engine>
>>
>> Deploy your web application(s) to webapps as usual.
>>
>> Deploy a ROOT web application to webapps-other that rejects all requests
>> with a 4xx response of your choice. I'd do that with a servlet mapped to
>> "/". YMMV.
>>
>> Additional configuration may be required for TLS but since you haven't
>> provided your connector information...
>>
>> Mark
>>
>>
>>> <!-- An Engine represents the entry point (within Catalina) that
>> processes
>>> every request. The Engine implementation for Tomcat stand alone
>>> analyzes the HTTP headers included with the request, and passes them
>>> on to the appropriate Host (virtual host).
>>> Documentation at /docs/config/engine.html -->
>>>
>>> <!-- You should set jvmRoute to support load-balancing via AJP ie :
>>> <Engine name="Catalina" defaultHost="localhost" jvmRoute="jvm1">
>>> -->
>>> <Engine name="Catalina" defaultHost="localhost">
>>>
>>> <!--For clustering, please take a look at documentation at:
>>> /docs/cluster-howto.html (simple how to)
>>> /docs/config/cluster.html (reference documentation) -->
>>> <!--
>>> <Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"/>
>>> -->
>>>
>>> <!-- Use the LockOutRealm to prevent attempts to guess user passwords
>>> via a brute-force attack -->
>>> <Realm className="org.apache.catalina.realm.LockOutRealm">
>>> <!-- This Realm uses the UserDatabase configured in the global JNDI
>>> resources under the key "UserDatabase". Any edits
>>> that are performed against this UserDatabase are immediately
>>> available for use by the Realm. -->
>>> <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
>>> resourceName="UserDatabase"/>
>>> </Realm>
>>>
>>> <Host name="hblacsuat.hdfcbankuat.com" appBase="webapps"
>>> unpackWARs="true" autoDeploy="true">
>>>
>>> <Valve className="org.apache.catalina.valves.RemoteIpValve"
>>> remoteIpHeader="x-forwarded-for"
>>> proxiesHeader="x-forwarded-by"
>>> protocolHeader="x-forwarded-proto" />
>>>
>>> <!-- SingleSignOn valve, share authentication between web applications
>>> Documentation at: /docs/config/valve.html -->
>>> <!--
>>> <Valve className="org.apache.catalina.authenticator.SingleSignOn" />
>>> -->
>>>
>>> <!-- Access log processes all example.
>>> Documentation at: /docs/config/valve.html
>>> Note: The pattern used is equivalent to using pattern="common" -->
>>> <Valve className="org.apache.catalina.valves.AccessLogValve"
>>> directory="logs"
>>> prefix="localhost_access_log" suffix=".txt"
>>> pattern="%h %l %u %t "%r" %s %b" />
>>>
>>> </Host>
>>> </Engine>
>>>
>>>
>>> Thanks & Regards,
>>> Anushka Sur
>>>
>>>
>>> On Tue, 21 Jul, 2026, 19:27 Mark Thomas, <ma...@apache.org> wrote:
>>>
>>>> On 21/07/2026 11:15, Anushka sur wrote:
>>>>> Hi Mark,
>>>>>
>>>>> As you suggested, we created a dedicated virtual host in the |
>>>>> server.xml| file. However, even after adding the virtual host
>>>>> configuration, the issue still persists.
>>>>>
>>>>> For example, when we access the application using:
>>>>>
>>>>> |https://sdcoradb5.hdfc.com:8083/ORDS <
>> https://sdcoradb5.hdfc.com:8083/
>>>>> ORDS>|
>>>>>
>>>>> and replace |sdcoradb5.hdfc.com:8083 <http://sdcoradb5.hdfc.com:8083/
>>> |
>>>>> with |bing.com <http://bing.com/>|, the request is still being
>>>> redirected
>>>>> instead of being rejected.
>>>>
>>>> Which is it? http or https?
>>>>
>>>>> Could you please confirm whether our |server.xml| configuration is
>>>>> correct, or if there are any additional settings or configurations that
>>>>> need to be added to ensure only the intended host is accepted?
>>>>
>>>> I could, if you had provided details of your settings. Screenshots will
>>>> get rejected by the mailing list. It would be better to simply paste the
>>>> contents of server.xml into a plain text email.
>>>>
>>>> Mark
>>>>
>>>>
>>>>>
>>>>> Any guidance would be greatly appreciated.
>>>>>
>>>>> Thank you, Anushka Sur
>>>>>
>>>>> In the screenshot..we have taken other instance for testing
>>>>>
>>>>> Screenshot for your reference:--
>>>>>
>>>>>
>>>>>
>>>>>
>>>>> On Thu, 16 Jul, 2026, 11:40 Anushka sur, <anusur35@gmail.com
>>>>> <ma...@gmail.com>> wrote:
>>>>>
>>>>> Sorry for the confusion..We are using tomcat version 9.0.110
>>>>>
>>>>> On Thu, 16 Jul, 2026, 11:26 Anushka sur, <anusur35@gmail.com
>>>>> <ma...@gmail.com>> wrote:
>>>>>
>>>>> Hi everyone,
>>>>>
>>>>> Thanks for the feedback. You are right — Tomcat 9.0.110 is
>> very
>>>>> old, and we will treat the upgrade as the first remediation
>> step.
>>>>>
>>>>> We will check the issue on a newer supported Tomcat release
>> and
>>>>> verify whether the redirect problem is still reproducible
>> there.
>>>>> If it is fixed by the upgrade, we will proceed with the newer
>>>>> version
>>>>>
>>>>> if not, as suggested by mark thomas we will create virtual
>> host.
>>>>>
>>>>> Thanks for pointing this out.
>>>>>
>>>>> Best regards,
>>>>> Anushka Sur
>>>>>
>>>>> On Thu, 16 Jul, 2026, 01:33 Christopher Schultz,
>>>>> <chris@christopherschultz.net
>>>>> <ma...@christopherschultz.net>> wrote:
>>>>>
>>>>> Mark,
>>>>>
>>>>> On 7/15/26 9:56 AM, Mark Thomas wrote:
>>>>> > 15 Jul 2026 11:10:41 Anushka sur <anusur35@gmail.com
>>>>> <ma...@gmail.com>>:
>>>>> >
>>>>> >> We have identified a VAPT issue in our Oracle APEX
>>>>> application
>>>>> >> deployed on
>>>>> >> ORDS 24.1.11 running on Apache Tomcat 9.0.11.
>>>>> >
>>>>> > That is horribly out of date. You might want to check
>> the
>>>>> list of
>>>>> > published CVEs for 9.0.x
>>>>>
>>>>> +1
>>>>>
>>>>> The real VAPT issue should be "holy @#$%&* your Tomcat
>>>>> version is *how*
>>>>> old?"
>>>>>
>>>>> -chris
>>>>>
>>
>> I am gustavo.avitabile@unina.it
>> I am non concerned with this thread at all, I'm reading just for
>> curiosi=
>> ty.
>> Then, why is my address gustavo.avitabile@unina.it appearing in the
>> url'=
>> s you quote?
>>
>> SOLVED
>> The URL's reported in tne message ar not the original URL's the sender
>> icluded.
>> They have been rewritten by Outlook mail.
>> I hate this, but I must complain with Microsoft. It is not a Tomcat issue.
>> Gustavo Avitabile
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
>> For additional commands, e-mail: users-help@tomcat.apache.org
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
>> For additional commands, e-mail: users-help@tomcat.apache.org
>>
>>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Tomcat host header redirect issue
Posted by Anushka sur <an...@gmail.com>.
Hi Mark,
Thank you for your response, and I apologize for the delay.
We were in a change freeze period at the bank, so we were unable to make
any configuration changes during that time.
We have implemented the first recommendation by creating the required
virtual host for our application. However, we are currently struggling to
understand the second recommendation regarding configuring the default host
with a ROOT application that returns a 4xx response.
We are relatively new to Tomcat administration, and our application is an
Oracle APEX application.
Because of that, we are not sure how to create or configure the ROOT
application for the default host.
Could you please provide some guidance or point us to an example of how
this should be configured in a Tomcat + Oracle APEX environment?
We appreciate your patience and any assistance you can provide.
On Sun, 2 Aug, 2026, 12:13 GUSTAVO AVITABILE, <av...@unina.it> wrote:
>
>
>
> ________________________________________
> From: GUSTAVO AVITABILE <av...@unina.it>
> Sent: Friday, July 24, 2026 3:57 PM
> To: Tomcat Users List
> Subject: Re: Tomcat host header redirect issue
>
> Hi Team,
>
>
> ________________________________________
> From: Mark Thomas <ma...@apache.org>
> Sent: Thursday, July 23, 2026 3:14 PM
> To: users@tomcat.apache.org
> Subject: Re: Tomcat host header redirect issue
>
> On 23/07/2026 09:15, Anushka sur wrote:
> > Hi Mark,
> >
> > 1.It is https
>
> OK.
>
> > These is the settings for server.xml
>
> No, those are part of the settings from server.xml. Since you are using
> HTTPS then all of the Connector elements are relevant as well.
>
> I did ask for the contents of server.xml, not part of it.
>
> > 2.
>
> I'm surprised that even started.
>
> To repeat what I said previously:
>
> Set up one virtual host for the correct host name(s) and deploy your
> application to that host.
>
> Set up the default host with a ROOT that returns a 4xx response to all
> requests.
>
> That means you need TWO host elements. You only have one. And a
> reference to a default host that doesn't exist.
>
> The basics are:
>
> <Engine name="Catalina" defaultHost="other">
> <Host name="other" appBase="webapps-other" />
> <Host name="hblacsuat.hdfcbankuat.com" appBase="webapps" />
> </Engine>
>
> Deploy your web application(s) to webapps as usual.
>
> Deploy a ROOT web application to webapps-other that rejects all requests
> with a 4xx response of your choice. I'd do that with a servlet mapped to
> "/". YMMV.
>
> Additional configuration may be required for TLS but since you haven't
> provided your connector information...
>
> Mark
>
>
> > <!-- An Engine represents the entry point (within Catalina) that
> processes
> > every request. The Engine implementation for Tomcat stand alone
> > analyzes the HTTP headers included with the request, and passes them
> > on to the appropriate Host (virtual host).
> > Documentation at /docs/config/engine.html -->
> >
> > <!-- You should set jvmRoute to support load-balancing via AJP ie :
> > <Engine name="Catalina" defaultHost="localhost" jvmRoute="jvm1">
> > -->
> > <Engine name="Catalina" defaultHost="localhost">
> >
> > <!--For clustering, please take a look at documentation at:
> > /docs/cluster-howto.html (simple how to)
> > /docs/config/cluster.html (reference documentation) -->
> > <!--
> > <Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"/>
> > -->
> >
> > <!-- Use the LockOutRealm to prevent attempts to guess user passwords
> > via a brute-force attack -->
> > <Realm className="org.apache.catalina.realm.LockOutRealm">
> > <!-- This Realm uses the UserDatabase configured in the global JNDI
> > resources under the key "UserDatabase". Any edits
> > that are performed against this UserDatabase are immediately
> > available for use by the Realm. -->
> > <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
> > resourceName="UserDatabase"/>
> > </Realm>
> >
> > <Host name="hblacsuat.hdfcbankuat.com" appBase="webapps"
> > unpackWARs="true" autoDeploy="true">
> >
> > <Valve className="org.apache.catalina.valves.RemoteIpValve"
> > remoteIpHeader="x-forwarded-for"
> > proxiesHeader="x-forwarded-by"
> > protocolHeader="x-forwarded-proto" />
> >
> > <!-- SingleSignOn valve, share authentication between web applications
> > Documentation at: /docs/config/valve.html -->
> > <!--
> > <Valve className="org.apache.catalina.authenticator.SingleSignOn" />
> > -->
> >
> > <!-- Access log processes all example.
> > Documentation at: /docs/config/valve.html
> > Note: The pattern used is equivalent to using pattern="common" -->
> > <Valve className="org.apache.catalina.valves.AccessLogValve"
> > directory="logs"
> > prefix="localhost_access_log" suffix=".txt"
> > pattern="%h %l %u %t "%r" %s %b" />
> >
> > </Host>
> > </Engine>
> >
> >
> > Thanks & Regards,
> > Anushka Sur
> >
> >
> > On Tue, 21 Jul, 2026, 19:27 Mark Thomas, <ma...@apache.org> wrote:
> >
> >> On 21/07/2026 11:15, Anushka sur wrote:
> >>> Hi Mark,
> >>>
> >>> As you suggested, we created a dedicated virtual host in the |
> >>> server.xml| file. However, even after adding the virtual host
> >>> configuration, the issue still persists.
> >>>
> >>> For example, when we access the application using:
> >>>
> >>> |https://sdcoradb5.hdfc.com:8083/ORDS <
> https://sdcoradb5.hdfc.com:8083/
> >>> ORDS>|
> >>>
> >>> and replace |sdcoradb5.hdfc.com:8083 <http://sdcoradb5.hdfc.com:8083/
> >|
> >>> with |bing.com <http://bing.com/>|, the request is still being
> >> redirected
> >>> instead of being rejected.
> >>
> >> Which is it? http or https?
> >>
> >>> Could you please confirm whether our |server.xml| configuration is
> >>> correct, or if there are any additional settings or configurations that
> >>> need to be added to ensure only the intended host is accepted?
> >>
> >> I could, if you had provided details of your settings. Screenshots will
> >> get rejected by the mailing list. It would be better to simply paste the
> >> contents of server.xml into a plain text email.
> >>
> >> Mark
> >>
> >>
> >>>
> >>> Any guidance would be greatly appreciated.
> >>>
> >>> Thank you, Anushka Sur
> >>>
> >>> In the screenshot..we have taken other instance for testing
> >>>
> >>> Screenshot for your reference:--
> >>>
> >>>
> >>>
> >>>
> >>> On Thu, 16 Jul, 2026, 11:40 Anushka sur, <anusur35@gmail.com
> >>> <ma...@gmail.com>> wrote:
> >>>
> >>> Sorry for the confusion..We are using tomcat version 9.0.110
> >>>
> >>> On Thu, 16 Jul, 2026, 11:26 Anushka sur, <anusur35@gmail.com
> >>> <ma...@gmail.com>> wrote:
> >>>
> >>> Hi everyone,
> >>>
> >>> Thanks for the feedback. You are right — Tomcat 9.0.110 is
> very
> >>> old, and we will treat the upgrade as the first remediation
> step.
> >>>
> >>> We will check the issue on a newer supported Tomcat release
> and
> >>> verify whether the redirect problem is still reproducible
> there.
> >>> If it is fixed by the upgrade, we will proceed with the newer
> >>> version
> >>>
> >>> if not, as suggested by mark thomas we will create virtual
> host.
> >>>
> >>> Thanks for pointing this out.
> >>>
> >>> Best regards,
> >>> Anushka Sur
> >>>
> >>> On Thu, 16 Jul, 2026, 01:33 Christopher Schultz,
> >>> <chris@christopherschultz.net
> >>> <ma...@christopherschultz.net>> wrote:
> >>>
> >>> Mark,
> >>>
> >>> On 7/15/26 9:56 AM, Mark Thomas wrote:
> >>> > 15 Jul 2026 11:10:41 Anushka sur <anusur35@gmail.com
> >>> <ma...@gmail.com>>:
> >>> >
> >>> >> We have identified a VAPT issue in our Oracle APEX
> >>> application
> >>> >> deployed on
> >>> >> ORDS 24.1.11 running on Apache Tomcat 9.0.11.
> >>> >
> >>> > That is horribly out of date. You might want to check
> the
> >>> list of
> >>> > published CVEs for 9.0.x
> >>>
> >>> +1
> >>>
> >>> The real VAPT issue should be "holy @#$%&* your Tomcat
> >>> version is *how*
> >>> old?"
> >>>
> >>> -chris
> >>>
>
> I am gustavo.avitabile@unina.it
> I am non concerned with this thread at all, I'm reading just for
> curiosi=
> ty.
> Then, why is my address gustavo.avitabile@unina.it appearing in the
> url'=
> s you quote?
>
> SOLVED
> The URL's reported in tne message ar not the original URL's the sender
> icluded.
> They have been rewritten by Outlook mail.
> I hate this, but I must complain with Microsoft. It is not a Tomcat issue.
> Gustavo Avitabile
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
Re: Tomcat host header redirect issue
Posted by GUSTAVO AVITABILE <av...@unina.it>.
________________________________________
From: GUSTAVO AVITABILE <av...@unina.it>
Sent: Friday, July 24, 2026 3:57 PM
To: Tomcat Users List
Subject: Re: Tomcat host header redirect issue
Hi Team,
________________________________________
From: Mark Thomas <ma...@apache.org>
Sent: Thursday, July 23, 2026 3:14 PM
To: users@tomcat.apache.org
Subject: Re: Tomcat host header redirect issue
On 23/07/2026 09:15, Anushka sur wrote:
> Hi Mark,
>
> 1.It is https
OK.
> These is the settings for server.xml
No, those are part of the settings from server.xml. Since you are using
HTTPS then all of the Connector elements are relevant as well.
I did ask for the contents of server.xml, not part of it.
> 2.
I'm surprised that even started.
To repeat what I said previously:
Set up one virtual host for the correct host name(s) and deploy your
application to that host.
Set up the default host with a ROOT that returns a 4xx response to all
requests.
That means you need TWO host elements. You only have one. And a
reference to a default host that doesn't exist.
The basics are:
<Engine name="Catalina" defaultHost="other">
<Host name="other" appBase="webapps-other" />
<Host name="hblacsuat.hdfcbankuat.com" appBase="webapps" />
</Engine>
Deploy your web application(s) to webapps as usual.
Deploy a ROOT web application to webapps-other that rejects all requests
with a 4xx response of your choice. I'd do that with a servlet mapped to
"/". YMMV.
Additional configuration may be required for TLS but since you haven't
provided your connector information...
Mark
> <!-- An Engine represents the entry point (within Catalina) that processes
> every request. The Engine implementation for Tomcat stand alone
> analyzes the HTTP headers included with the request, and passes them
> on to the appropriate Host (virtual host).
> Documentation at /docs/config/engine.html -->
>
> <!-- You should set jvmRoute to support load-balancing via AJP ie :
> <Engine name="Catalina" defaultHost="localhost" jvmRoute="jvm1">
> -->
> <Engine name="Catalina" defaultHost="localhost">
>
> <!--For clustering, please take a look at documentation at:
> /docs/cluster-howto.html (simple how to)
> /docs/config/cluster.html (reference documentation) -->
> <!--
> <Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"/>
> -->
>
> <!-- Use the LockOutRealm to prevent attempts to guess user passwords
> via a brute-force attack -->
> <Realm className="org.apache.catalina.realm.LockOutRealm">
> <!-- This Realm uses the UserDatabase configured in the global JNDI
> resources under the key "UserDatabase". Any edits
> that are performed against this UserDatabase are immediately
> available for use by the Realm. -->
> <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
> resourceName="UserDatabase"/>
> </Realm>
>
> <Host name="hblacsuat.hdfcbankuat.com" appBase="webapps"
> unpackWARs="true" autoDeploy="true">
>
> <Valve className="org.apache.catalina.valves.RemoteIpValve"
> remoteIpHeader="x-forwarded-for"
> proxiesHeader="x-forwarded-by"
> protocolHeader="x-forwarded-proto" />
>
> <!-- SingleSignOn valve, share authentication between web applications
> Documentation at: /docs/config/valve.html -->
> <!--
> <Valve className="org.apache.catalina.authenticator.SingleSignOn" />
> -->
>
> <!-- Access log processes all example.
> Documentation at: /docs/config/valve.html
> Note: The pattern used is equivalent to using pattern="common" -->
> <Valve className="org.apache.catalina.valves.AccessLogValve"
> directory="logs"
> prefix="localhost_access_log" suffix=".txt"
> pattern="%h %l %u %t "%r" %s %b" />
>
> </Host>
> </Engine>
>
>
> Thanks & Regards,
> Anushka Sur
>
>
> On Tue, 21 Jul, 2026, 19:27 Mark Thomas, <ma...@apache.org> wrote:
>
>> On 21/07/2026 11:15, Anushka sur wrote:
>>> Hi Mark,
>>>
>>> As you suggested, we created a dedicated virtual host in the |
>>> server.xml| file. However, even after adding the virtual host
>>> configuration, the issue still persists.
>>>
>>> For example, when we access the application using:
>>>
>>> |https://sdcoradb5.hdfc.com:8083/ORDS <https://sdcoradb5.hdfc.com:8083/
>>> ORDS>|
>>>
>>> and replace |sdcoradb5.hdfc.com:8083 <http://sdcoradb5.hdfc.com:8083/>|
>>> with |bing.com <http://bing.com/>|, the request is still being
>> redirected
>>> instead of being rejected.
>>
>> Which is it? http or https?
>>
>>> Could you please confirm whether our |server.xml| configuration is
>>> correct, or if there are any additional settings or configurations that
>>> need to be added to ensure only the intended host is accepted?
>>
>> I could, if you had provided details of your settings. Screenshots will
>> get rejected by the mailing list. It would be better to simply paste the
>> contents of server.xml into a plain text email.
>>
>> Mark
>>
>>
>>>
>>> Any guidance would be greatly appreciated.
>>>
>>> Thank you, Anushka Sur
>>>
>>> In the screenshot..we have taken other instance for testing
>>>
>>> Screenshot for your reference:--
>>>
>>>
>>>
>>>
>>> On Thu, 16 Jul, 2026, 11:40 Anushka sur, <anusur35@gmail.com
>>> <ma...@gmail.com>> wrote:
>>>
>>> Sorry for the confusion..We are using tomcat version 9.0.110
>>>
>>> On Thu, 16 Jul, 2026, 11:26 Anushka sur, <anusur35@gmail.com
>>> <ma...@gmail.com>> wrote:
>>>
>>> Hi everyone,
>>>
>>> Thanks for the feedback. You are right — Tomcat 9.0.110 is very
>>> old, and we will treat the upgrade as the first remediation step.
>>>
>>> We will check the issue on a newer supported Tomcat release and
>>> verify whether the redirect problem is still reproducible there.
>>> If it is fixed by the upgrade, we will proceed with the newer
>>> version
>>>
>>> if not, as suggested by mark thomas we will create virtual host.
>>>
>>> Thanks for pointing this out.
>>>
>>> Best regards,
>>> Anushka Sur
>>>
>>> On Thu, 16 Jul, 2026, 01:33 Christopher Schultz,
>>> <chris@christopherschultz.net
>>> <ma...@christopherschultz.net>> wrote:
>>>
>>> Mark,
>>>
>>> On 7/15/26 9:56 AM, Mark Thomas wrote:
>>> > 15 Jul 2026 11:10:41 Anushka sur <anusur35@gmail.com
>>> <ma...@gmail.com>>:
>>> >
>>> >> We have identified a VAPT issue in our Oracle APEX
>>> application
>>> >> deployed on
>>> >> ORDS 24.1.11 running on Apache Tomcat 9.0.11.
>>> >
>>> > That is horribly out of date. You might want to check the
>>> list of
>>> > published CVEs for 9.0.x
>>>
>>> +1
>>>
>>> The real VAPT issue should be "holy @#$%&* your Tomcat
>>> version is *how*
>>> old?"
>>>
>>> -chris
>>>
I am gustavo.avitabile@unina.it
I am non concerned with this thread at all, I'm reading just for curiosi=
ty.
Then, why is my address gustavo.avitabile@unina.it appearing in the url'=
s you quote?
SOLVED
The URL's reported in tne message ar not the original URL's the sender icluded.
They have been rewritten by Outlook mail.
I hate this, but I must complain with Microsoft. It is not a Tomcat issue.
Gustavo Avitabile
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Tomcat host header redirect issue
Posted by GUSTAVO AVITABILE <av...@unina.it>.
Hi Team,
________________________________________
From: Mark Thomas <ma...@apache.org>
Sent: Thursday, July 23, 2026 3:14 PM
To: users@tomcat.apache.org
Subject: Re: Tomcat host header redirect issue
On 23/07/2026 09:15, Anushka sur wrote:
> Hi Mark,
>
> 1.It is https
OK.
> These is the settings for server.xml
No, those are part of the settings from server.xml. Since you are using
HTTPS then all of the Connector elements are relevant as well.
I did ask for the contents of server.xml, not part of it.
> 2.
I'm surprised that even started.
To repeat what I said previously:
Set up one virtual host for the correct host name(s) and deploy your
application to that host.
Set up the default host with a ROOT that returns a 4xx response to all
requests.
That means you need TWO host elements. You only have one. And a
reference to a default host that doesn't exist.
The basics are:
<Engine name="Catalina" defaultHost="other">
<Host name="other" appBase="webapps-other" />
<Host name="hblacsuat.hdfcbankuat.com" appBase="webapps" />
</Engine>
Deploy your web application(s) to webapps as usual.
Deploy a ROOT web application to webapps-other that rejects all requests
with a 4xx response of your choice. I'd do that with a servlet mapped to
"/". YMMV.
Additional configuration may be required for TLS but since you haven't
provided your connector information...
Mark
> <!-- An Engine represents the entry point (within Catalina) that processes
> every request. The Engine implementation for Tomcat stand alone
> analyzes the HTTP headers included with the request, and passes them
> on to the appropriate Host (virtual host).
> Documentation at /docs/config/engine.html -->
>
> <!-- You should set jvmRoute to support load-balancing via AJP ie :
> <Engine name="Catalina" defaultHost="localhost" jvmRoute="jvm1">
> -->
> <Engine name="Catalina" defaultHost="localhost">
>
> <!--For clustering, please take a look at documentation at:
> /docs/cluster-howto.html (simple how to)
> /docs/config/cluster.html (reference documentation) -->
> <!--
> <Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"/>
> -->
>
> <!-- Use the LockOutRealm to prevent attempts to guess user passwords
> via a brute-force attack -->
> <Realm className="org.apache.catalina.realm.LockOutRealm">
> <!-- This Realm uses the UserDatabase configured in the global JNDI
> resources under the key "UserDatabase". Any edits
> that are performed against this UserDatabase are immediately
> available for use by the Realm. -->
> <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
> resourceName="UserDatabase"/>
> </Realm>
>
> <Host name="hblacsuat.hdfcbankuat.com" appBase="webapps"
> unpackWARs="true" autoDeploy="true">
>
> <Valve className="org.apache.catalina.valves.RemoteIpValve"
> remoteIpHeader="x-forwarded-for"
> proxiesHeader="x-forwarded-by"
> protocolHeader="x-forwarded-proto" />
>
> <!-- SingleSignOn valve, share authentication between web applications
> Documentation at: /docs/config/valve.html -->
> <!--
> <Valve className="org.apache.catalina.authenticator.SingleSignOn" />
> -->
>
> <!-- Access log processes all example.
> Documentation at: /docs/config/valve.html
> Note: The pattern used is equivalent to using pattern="common" -->
> <Valve className="org.apache.catalina.valves.AccessLogValve"
> directory="logs"
> prefix="localhost_access_log" suffix=".txt"
> pattern="%h %l %u %t "%r" %s %b" />
>
> </Host>
> </Engine>
>
>
> Thanks & Regards,
> Anushka Sur
>
>
> On Tue, 21 Jul, 2026, 19:27 Mark Thomas, <ma...@apache.org> wrote:
>
>> On 21/07/2026 11:15, Anushka sur wrote:
>>> Hi Mark,
>>>
>>> As you suggested, we created a dedicated virtual host in the |
>>> server.xml| file. However, even after adding the virtual host
>>> configuration, the issue still persists.
>>>
>>> For example, when we access the application using:
>>>
>>> |https://sdcoradb5.hdfc.com:8083/ORDS <https://sdcoradb5.hdfc.com:8083/
>>> ORDS>|
>>>
>>> and replace |sdcoradb5.hdfc.com:8083 <http://sdcoradb5.hdfc.com:8083/>|
>>> with |bing.com <http://bing.com/>|, the request is still being
>> redirected
>>> instead of being rejected.
>>
>> Which is it? http or https?
>>
>>> Could you please confirm whether our |server.xml| configuration is
>>> correct, or if there are any additional settings or configurations that
>>> need to be added to ensure only the intended host is accepted?
>>
>> I could, if you had provided details of your settings. Screenshots will
>> get rejected by the mailing list. It would be better to simply paste the
>> contents of server.xml into a plain text email.
>>
>> Mark
>>
>>
>>>
>>> Any guidance would be greatly appreciated.
>>>
>>> Thank you, Anushka Sur
>>>
>>> In the screenshot..we have taken other instance for testing
>>>
>>> Screenshot for your reference:--
>>>
>>>
>>>
>>>
>>> On Thu, 16 Jul, 2026, 11:40 Anushka sur, <anusur35@gmail.com
>>> <ma...@gmail.com>> wrote:
>>>
>>> Sorry for the confusion..We are using tomcat version 9.0.110
>>>
>>> On Thu, 16 Jul, 2026, 11:26 Anushka sur, <anusur35@gmail.com
>>> <ma...@gmail.com>> wrote:
>>>
>>> Hi everyone,
>>>
>>> Thanks for the feedback. You are right — Tomcat 9.0.110 is very
>>> old, and we will treat the upgrade as the first remediation step.
>>>
>>> We will check the issue on a newer supported Tomcat release and
>>> verify whether the redirect problem is still reproducible there.
>>> If it is fixed by the upgrade, we will proceed with the newer
>>> version
>>>
>>> if not, as suggested by mark thomas we will create virtual host.
>>>
>>> Thanks for pointing this out.
>>>
>>> Best regards,
>>> Anushka Sur
>>>
>>> On Thu, 16 Jul, 2026, 01:33 Christopher Schultz,
>>> <chris@christopherschultz.net
>>> <ma...@christopherschultz.net>> wrote:
>>>
>>> Mark,
>>>
>>> On 7/15/26 9:56 AM, Mark Thomas wrote:
>>> > 15 Jul 2026 11:10:41 Anushka sur <anusur35@gmail.com
>>> <ma...@gmail.com>>:
>>> >
>>> >> We have identified a VAPT issue in our Oracle APEX
>>> application
>>> >> deployed on
>>> >> ORDS 24.1.11 running on Apache Tomcat 9.0.11.
>>> >
>>> > That is horribly out of date. You might want to check the
>>> list of
>>> > published CVEs for 9.0.x
>>>
>>> +1
>>>
>>> The real VAPT issue should be "holy @#$%&* your Tomcat
>>> version is *how*
>>> old?"
>>>
>>> -chris
>>>
I am gustavo.avitabile@unina.it
I am non concerned with this thread at all, I'm reading just for curiosi=
ty.
Then, why is my address gustavo.avitabile@unina.it appearing in the url'=
s you quote?
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Tomcat host header redirect issue
Posted by Mark Thomas <ma...@apache.org>.
On 23/07/2026 09:15, Anushka sur wrote:
> Hi Mark,
>
> 1.It is https
OK.
> These is the settings for server.xml
No, those are part of the settings from server.xml. Since you are using
HTTPS then all of the Connector elements are relevant as well.
I did ask for the contents of server.xml, not part of it.
> 2.
I'm surprised that even started.
To repeat what I said previously:
Set up one virtual host for the correct host name(s) and deploy your
application to that host.
Set up the default host with a ROOT that returns a 4xx response to all
requests.
That means you need TWO host elements. You only have one. And a
reference to a default host that doesn't exist.
The basics are:
<Engine name="Catalina" defaultHost="other">
<Host name="other" appBase="webapps-other" />
<Host name="hblacsuat.hdfcbankuat.com" appBase="webapps" />
</Engine>
Deploy your web application(s) to webapps as usual.
Deploy a ROOT web application to webapps-other that rejects all requests
with a 4xx response of your choice. I'd do that with a servlet mapped to
"/". YMMV.
Additional configuration may be required for TLS but since you haven't
provided your connector information...
Mark
> <!-- An Engine represents the entry point (within Catalina) that processes
> every request. The Engine implementation for Tomcat stand alone
> analyzes the HTTP headers included with the request, and passes them
> on to the appropriate Host (virtual host).
> Documentation at /docs/config/engine.html -->
>
> <!-- You should set jvmRoute to support load-balancing via AJP ie :
> <Engine name="Catalina" defaultHost="localhost" jvmRoute="jvm1">
> -->
> <Engine name="Catalina" defaultHost="localhost">
>
> <!--For clustering, please take a look at documentation at:
> /docs/cluster-howto.html (simple how to)
> /docs/config/cluster.html (reference documentation) -->
> <!--
> <Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"/>
> -->
>
> <!-- Use the LockOutRealm to prevent attempts to guess user passwords
> via a brute-force attack -->
> <Realm className="org.apache.catalina.realm.LockOutRealm">
> <!-- This Realm uses the UserDatabase configured in the global JNDI
> resources under the key "UserDatabase". Any edits
> that are performed against this UserDatabase are immediately
> available for use by the Realm. -->
> <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
> resourceName="UserDatabase"/>
> </Realm>
>
> <Host name="hblacsuat.hdfcbankuat.com" appBase="webapps"
> unpackWARs="true" autoDeploy="true">
>
> <Valve className="org.apache.catalina.valves.RemoteIpValve"
> remoteIpHeader="x-forwarded-for"
> proxiesHeader="x-forwarded-by"
> protocolHeader="x-forwarded-proto" />
>
> <!-- SingleSignOn valve, share authentication between web applications
> Documentation at: /docs/config/valve.html -->
> <!--
> <Valve className="org.apache.catalina.authenticator.SingleSignOn" />
> -->
>
> <!-- Access log processes all example.
> Documentation at: /docs/config/valve.html
> Note: The pattern used is equivalent to using pattern="common" -->
> <Valve className="org.apache.catalina.valves.AccessLogValve"
> directory="logs"
> prefix="localhost_access_log" suffix=".txt"
> pattern="%h %l %u %t "%r" %s %b" />
>
> </Host>
> </Engine>
>
>
> Thanks & Regards,
> Anushka Sur
>
>
> On Tue, 21 Jul, 2026, 19:27 Mark Thomas, <ma...@apache.org> wrote:
>
>> On 21/07/2026 11:15, Anushka sur wrote:
>>> Hi Mark,
>>>
>>> As you suggested, we created a dedicated virtual host in the |
>>> server.xml| file. However, even after adding the virtual host
>>> configuration, the issue still persists.
>>>
>>> For example, when we access the application using:
>>>
>>> |https://sdcoradb5.hdfc.com:8083/ORDS <https://sdcoradb5.hdfc.com:8083/
>>> ORDS>|
>>>
>>> and replace |sdcoradb5.hdfc.com:8083 <http://sdcoradb5.hdfc.com:8083>|
>>> with |bing.com <http://bing.com>|, the request is still being
>> redirected
>>> instead of being rejected.
>>
>> Which is it? http or https?
>>
>>> Could you please confirm whether our |server.xml| configuration is
>>> correct, or if there are any additional settings or configurations that
>>> need to be added to ensure only the intended host is accepted?
>>
>> I could, if you had provided details of your settings. Screenshots will
>> get rejected by the mailing list. It would be better to simply paste the
>> contents of server.xml into a plain text email.
>>
>> Mark
>>
>>
>>>
>>> Any guidance would be greatly appreciated.
>>>
>>> Thank you, Anushka Sur
>>>
>>> In the screenshot..we have taken other instance for testing
>>>
>>> Screenshot for your reference:--
>>>
>>>
>>>
>>>
>>> On Thu, 16 Jul, 2026, 11:40 Anushka sur, <anusur35@gmail.com
>>> <ma...@gmail.com>> wrote:
>>>
>>> Sorry for the confusion..We are using tomcat version 9.0.110
>>>
>>> On Thu, 16 Jul, 2026, 11:26 Anushka sur, <anusur35@gmail.com
>>> <ma...@gmail.com>> wrote:
>>>
>>> Hi everyone,
>>>
>>> Thanks for the feedback. You are right — Tomcat 9.0.110 is very
>>> old, and we will treat the upgrade as the first remediation step.
>>>
>>> We will check the issue on a newer supported Tomcat release and
>>> verify whether the redirect problem is still reproducible there.
>>> If it is fixed by the upgrade, we will proceed with the newer
>>> version
>>>
>>> if not, as suggested by mark thomas we will create virtual host.
>>>
>>> Thanks for pointing this out.
>>>
>>> Best regards,
>>> Anushka Sur
>>>
>>> On Thu, 16 Jul, 2026, 01:33 Christopher Schultz,
>>> <chris@christopherschultz.net
>>> <ma...@christopherschultz.net>> wrote:
>>>
>>> Mark,
>>>
>>> On 7/15/26 9:56 AM, Mark Thomas wrote:
>>> > 15 Jul 2026 11:10:41 Anushka sur <anusur35@gmail.com
>>> <ma...@gmail.com>>:
>>> >
>>> >> We have identified a VAPT issue in our Oracle APEX
>>> application
>>> >> deployed on
>>> >> ORDS 24.1.11 running on Apache Tomcat 9.0.11.
>>> >
>>> > That is horribly out of date. You might want to check the
>>> list of
>>> > published CVEs for 9.0.x
>>>
>>> +1
>>>
>>> The real VAPT issue should be "holy @#$%&* your Tomcat
>>> version is *how*
>>> old?"
>>>
>>> -chris
>>>
>>>
>>>
>> ---------------------------------------------------------------------
>>> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
>>> <ma...@tomcat.apache.org>
>>> For additional commands, e-mail: users-
>>> help@tomcat.apache.org <ma...@tomcat.apache.org>
>>>
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
>> For additional commands, e-mail: users-help@tomcat.apache.org
>>
>>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Tomcat host header redirect issue
Posted by Anushka sur <an...@gmail.com>.
Hi Team,
We have a few questions and would appreciate your clarification on them.
1
replace the hostname with an invalid or non-existent value (for example,
abc)
request reaches ORDS and returns a 404 error
2
replace the hostname with a valid public domain such as google.com, bing.com
request does not reach ORDS. Instead, the browser performs normal DNS
resolution and connects directly to Google's servers, resulting in Google's
home page being displayed
3
Added the below content in the .xml
file
<Valve
className="org.apache.catalina.valves.RemoteIpValve"remoteIpHeader="x-forwarded-for"proxiesHeader="x-forwarded-by"protocolHeader="x-forwarded-proto"
/>
Still the redirection occurs
4
Added the below content in the .xml
file
<Engine
name="Catalina" defaultHost="sdcoradb5.hdfc.com"> <Host name="
sdcoradb5.hdfc.com" appBase="webapps" .../></Engine>
Still the redirection occurs
5
Reg., the virtual host settings
Where should the virtual host be configured in the Tomcat configuration?
Does the virtual host refer to the combination of the hostname and domain
name?
Thanks and Regards,
Anushka Sur
On Thu, 23 Jul, 2026, 13:45 Anushka sur, <an...@gmail.com> wrote:
> Hi Mark,
>
>
> 1.It is https
>
>
> These is the settings for server.xml
>
> 2.<!-- An Engine represents the entry point (within Catalina) that
> processes
> every request. The Engine implementation for Tomcat stand alone
> analyzes the HTTP headers included with the request, and passes them
> on to the appropriate Host (virtual host).
> Documentation at /docs/config/engine.html -->
>
> <!-- You should set jvmRoute to support load-balancing via AJP ie :
> <Engine name="Catalina" defaultHost="localhost" jvmRoute="jvm1">
> -->
> <Engine name="Catalina" defaultHost="localhost">
>
> <!--For clustering, please take a look at documentation at:
> /docs/cluster-howto.html (simple how to)
> /docs/config/cluster.html (reference documentation) -->
> <!--
> <Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"/>
> -->
>
> <!-- Use the LockOutRealm to prevent attempts to guess user passwords
> via a brute-force attack -->
> <Realm className="org.apache.catalina.realm.LockOutRealm">
> <!-- This Realm uses the UserDatabase configured in the global JNDI
> resources under the key "UserDatabase". Any edits
> that are performed against this UserDatabase are immediately
> available for use by the Realm. -->
> <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
> resourceName="UserDatabase"/>
> </Realm>
>
> <Host name="hblacsuat.hdfcbankuat.com" appBase="webapps"
> unpackWARs="true" autoDeploy="true">
>
> <Valve className="org.apache.catalina.valves.RemoteIpValve"
> remoteIpHeader="x-forwarded-for"
> proxiesHeader="x-forwarded-by"
> protocolHeader="x-forwarded-proto" />
>
> <!-- SingleSignOn valve, share authentication between web applications
> Documentation at: /docs/config/valve.html -->
> <!--
> <Valve className="org.apache.catalina.authenticator.SingleSignOn" />
> -->
>
> <!-- Access log processes all example.
> Documentation at: /docs/config/valve.html
> Note: The pattern used is equivalent to using pattern="common" -->
> <Valve className="org.apache.catalina.valves.AccessLogValve"
> directory="logs"
> prefix="localhost_access_log" suffix=".txt"
> pattern="%h %l %u %t "%r" %s %b" />
>
> </Host>
> </Engine>
>
>
> Thanks & Regards,
> Anushka Sur
>
>
> On Tue, 21 Jul, 2026, 19:27 Mark Thomas, <ma...@apache.org> wrote:
>
>> On 21/07/2026 11:15, Anushka sur wrote:
>> > Hi Mark,
>> >
>> > As you suggested, we created a dedicated virtual host in the |
>> > server.xml| file. However, even after adding the virtual host
>> > configuration, the issue still persists.
>> >
>> > For example, when we access the application using:
>> >
>> > |https://sdcoradb5.hdfc.com:8083/ORDS <https://sdcoradb5.hdfc.com:8083/
>> > ORDS>|
>> >
>> > and replace |sdcoradb5.hdfc.com:8083 <http://sdcoradb5.hdfc.com:8083>|
>> > with |bing.com <http://bing.com>|, the request is still being
>> redirected
>> > instead of being rejected.
>>
>> Which is it? http or https?
>>
>> > Could you please confirm whether our |server.xml| configuration is
>> > correct, or if there are any additional settings or configurations that
>> > need to be added to ensure only the intended host is accepted?
>>
>> I could, if you had provided details of your settings. Screenshots will
>> get rejected by the mailing list. It would be better to simply paste the
>> contents of server.xml into a plain text email.
>>
>> Mark
>>
>>
>> >
>> > Any guidance would be greatly appreciated.
>> >
>> > Thank you, Anushka Sur
>> >
>> > In the screenshot..we have taken other instance for testing
>> >
>> > Screenshot for your reference:--
>> >
>> >
>> >
>> >
>> > On Thu, 16 Jul, 2026, 11:40 Anushka sur, <anusur35@gmail.com
>> > <ma...@gmail.com>> wrote:
>> >
>> > Sorry for the confusion..We are using tomcat version 9.0.110
>> >
>> > On Thu, 16 Jul, 2026, 11:26 Anushka sur, <anusur35@gmail.com
>> > <ma...@gmail.com>> wrote:
>> >
>> > Hi everyone,
>> >
>> > Thanks for the feedback. You are right — Tomcat 9.0.110 is very
>> > old, and we will treat the upgrade as the first remediation
>> step.
>> >
>> > We will check the issue on a newer supported Tomcat release and
>> > verify whether the redirect problem is still reproducible there.
>> > If it is fixed by the upgrade, we will proceed with the newer
>> > version
>> >
>> > if not, as suggested by mark thomas we will create virtual host.
>> >
>> > Thanks for pointing this out.
>> >
>> > Best regards,
>> > Anushka Sur
>> >
>> > On Thu, 16 Jul, 2026, 01:33 Christopher Schultz,
>> > <chris@christopherschultz.net
>> > <ma...@christopherschultz.net>> wrote:
>> >
>> > Mark,
>> >
>> > On 7/15/26 9:56 AM, Mark Thomas wrote:
>> > > 15 Jul 2026 11:10:41 Anushka sur <anusur35@gmail.com
>> > <ma...@gmail.com>>:
>> > >
>> > >> We have identified a VAPT issue in our Oracle APEX
>> > application
>> > >> deployed on
>> > >> ORDS 24.1.11 running on Apache Tomcat 9.0.11.
>> > >
>> > > That is horribly out of date. You might want to check the
>> > list of
>> > > published CVEs for 9.0.x
>> >
>> > +1
>> >
>> > The real VAPT issue should be "holy @#$%&* your Tomcat
>> > version is *how*
>> > old?"
>> >
>> > -chris
>> >
>> >
>> >
>> ---------------------------------------------------------------------
>> > To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
>> > <ma...@tomcat.apache.org>
>> > For additional commands, e-mail: users-
>> > help@tomcat.apache.org <mailto:users-help@tomcat.apache.org
>> >
>> >
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
>> For additional commands, e-mail: users-help@tomcat.apache.org
>>
>>
Re: Tomcat host header redirect issue
Posted by Anushka sur <an...@gmail.com>.
Hi Mark,
1.It is https
These is the settings for server.xml
2.<!-- An Engine represents the entry point (within Catalina) that processes
every request. The Engine implementation for Tomcat stand alone
analyzes the HTTP headers included with the request, and passes them
on to the appropriate Host (virtual host).
Documentation at /docs/config/engine.html -->
<!-- You should set jvmRoute to support load-balancing via AJP ie :
<Engine name="Catalina" defaultHost="localhost" jvmRoute="jvm1">
-->
<Engine name="Catalina" defaultHost="localhost">
<!--For clustering, please take a look at documentation at:
/docs/cluster-howto.html (simple how to)
/docs/config/cluster.html (reference documentation) -->
<!--
<Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"/>
-->
<!-- Use the LockOutRealm to prevent attempts to guess user passwords
via a brute-force attack -->
<Realm className="org.apache.catalina.realm.LockOutRealm">
<!-- This Realm uses the UserDatabase configured in the global JNDI
resources under the key "UserDatabase". Any edits
that are performed against this UserDatabase are immediately
available for use by the Realm. -->
<Realm className="org.apache.catalina.realm.UserDatabaseRealm"
resourceName="UserDatabase"/>
</Realm>
<Host name="hblacsuat.hdfcbankuat.com" appBase="webapps"
unpackWARs="true" autoDeploy="true">
<Valve className="org.apache.catalina.valves.RemoteIpValve"
remoteIpHeader="x-forwarded-for"
proxiesHeader="x-forwarded-by"
protocolHeader="x-forwarded-proto" />
<!-- SingleSignOn valve, share authentication between web applications
Documentation at: /docs/config/valve.html -->
<!--
<Valve className="org.apache.catalina.authenticator.SingleSignOn" />
-->
<!-- Access log processes all example.
Documentation at: /docs/config/valve.html
Note: The pattern used is equivalent to using pattern="common" -->
<Valve className="org.apache.catalina.valves.AccessLogValve"
directory="logs"
prefix="localhost_access_log" suffix=".txt"
pattern="%h %l %u %t "%r" %s %b" />
</Host>
</Engine>
Thanks & Regards,
Anushka Sur
On Tue, 21 Jul, 2026, 19:27 Mark Thomas, <ma...@apache.org> wrote:
> On 21/07/2026 11:15, Anushka sur wrote:
> > Hi Mark,
> >
> > As you suggested, we created a dedicated virtual host in the |
> > server.xml| file. However, even after adding the virtual host
> > configuration, the issue still persists.
> >
> > For example, when we access the application using:
> >
> > |https://sdcoradb5.hdfc.com:8083/ORDS <https://sdcoradb5.hdfc.com:8083/
> > ORDS>|
> >
> > and replace |sdcoradb5.hdfc.com:8083 <http://sdcoradb5.hdfc.com:8083>|
> > with |bing.com <http://bing.com>|, the request is still being
> redirected
> > instead of being rejected.
>
> Which is it? http or https?
>
> > Could you please confirm whether our |server.xml| configuration is
> > correct, or if there are any additional settings or configurations that
> > need to be added to ensure only the intended host is accepted?
>
> I could, if you had provided details of your settings. Screenshots will
> get rejected by the mailing list. It would be better to simply paste the
> contents of server.xml into a plain text email.
>
> Mark
>
>
> >
> > Any guidance would be greatly appreciated.
> >
> > Thank you, Anushka Sur
> >
> > In the screenshot..we have taken other instance for testing
> >
> > Screenshot for your reference:--
> >
> >
> >
> >
> > On Thu, 16 Jul, 2026, 11:40 Anushka sur, <anusur35@gmail.com
> > <ma...@gmail.com>> wrote:
> >
> > Sorry for the confusion..We are using tomcat version 9.0.110
> >
> > On Thu, 16 Jul, 2026, 11:26 Anushka sur, <anusur35@gmail.com
> > <ma...@gmail.com>> wrote:
> >
> > Hi everyone,
> >
> > Thanks for the feedback. You are right — Tomcat 9.0.110 is very
> > old, and we will treat the upgrade as the first remediation step.
> >
> > We will check the issue on a newer supported Tomcat release and
> > verify whether the redirect problem is still reproducible there.
> > If it is fixed by the upgrade, we will proceed with the newer
> > version
> >
> > if not, as suggested by mark thomas we will create virtual host.
> >
> > Thanks for pointing this out.
> >
> > Best regards,
> > Anushka Sur
> >
> > On Thu, 16 Jul, 2026, 01:33 Christopher Schultz,
> > <chris@christopherschultz.net
> > <ma...@christopherschultz.net>> wrote:
> >
> > Mark,
> >
> > On 7/15/26 9:56 AM, Mark Thomas wrote:
> > > 15 Jul 2026 11:10:41 Anushka sur <anusur35@gmail.com
> > <ma...@gmail.com>>:
> > >
> > >> We have identified a VAPT issue in our Oracle APEX
> > application
> > >> deployed on
> > >> ORDS 24.1.11 running on Apache Tomcat 9.0.11.
> > >
> > > That is horribly out of date. You might want to check the
> > list of
> > > published CVEs for 9.0.x
> >
> > +1
> >
> > The real VAPT issue should be "holy @#$%&* your Tomcat
> > version is *how*
> > old?"
> >
> > -chris
> >
> >
> >
> ---------------------------------------------------------------------
> > To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> > <ma...@tomcat.apache.org>
> > For additional commands, e-mail: users-
> > help@tomcat.apache.org <ma...@tomcat.apache.org>
> >
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
Re: Tomcat host header redirect issue
Posted by Mark Thomas <ma...@apache.org>.
On 21/07/2026 11:15, Anushka sur wrote:
> Hi Mark,
>
> As you suggested, we created a dedicated virtual host in the |
> server.xml| file. However, even after adding the virtual host
> configuration, the issue still persists.
>
> For example, when we access the application using:
>
> |https://sdcoradb5.hdfc.com:8083/ORDS <https://sdcoradb5.hdfc.com:8083/
> ORDS>|
>
> and replace |sdcoradb5.hdfc.com:8083 <http://sdcoradb5.hdfc.com:8083>|
> with |bing.com <http://bing.com>|, the request is still being redirected
> instead of being rejected.
Which is it? http or https?
> Could you please confirm whether our |server.xml| configuration is
> correct, or if there are any additional settings or configurations that
> need to be added to ensure only the intended host is accepted?
I could, if you had provided details of your settings. Screenshots will
get rejected by the mailing list. It would be better to simply paste the
contents of server.xml into a plain text email.
Mark
>
> Any guidance would be greatly appreciated.
>
> Thank you, Anushka Sur
>
> In the screenshot..we have taken other instance for testing
>
> Screenshot for your reference:--
>
>
>
>
> On Thu, 16 Jul, 2026, 11:40 Anushka sur, <anusur35@gmail.com
> <ma...@gmail.com>> wrote:
>
> Sorry for the confusion..We are using tomcat version 9.0.110
>
> On Thu, 16 Jul, 2026, 11:26 Anushka sur, <anusur35@gmail.com
> <ma...@gmail.com>> wrote:
>
> Hi everyone,
>
> Thanks for the feedback. You are right — Tomcat 9.0.110 is very
> old, and we will treat the upgrade as the first remediation step.
>
> We will check the issue on a newer supported Tomcat release and
> verify whether the redirect problem is still reproducible there.
> If it is fixed by the upgrade, we will proceed with the newer
> version
>
> if not, as suggested by mark thomas we will create virtual host.
>
> Thanks for pointing this out.
>
> Best regards,
> Anushka Sur
>
> On Thu, 16 Jul, 2026, 01:33 Christopher Schultz,
> <chris@christopherschultz.net
> <ma...@christopherschultz.net>> wrote:
>
> Mark,
>
> On 7/15/26 9:56 AM, Mark Thomas wrote:
> > 15 Jul 2026 11:10:41 Anushka sur <anusur35@gmail.com
> <ma...@gmail.com>>:
> >
> >> We have identified a VAPT issue in our Oracle APEX
> application
> >> deployed on
> >> ORDS 24.1.11 running on Apache Tomcat 9.0.11.
> >
> > That is horribly out of date. You might want to check the
> list of
> > published CVEs for 9.0.x
>
> +1
>
> The real VAPT issue should be "holy @#$%&* your Tomcat
> version is *how*
> old?"
>
> -chris
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> <ma...@tomcat.apache.org>
> For additional commands, e-mail: users-
> help@tomcat.apache.org <ma...@tomcat.apache.org>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Tomcat host header redirect issue
Posted by Anushka sur <an...@gmail.com>.
Hi Mark,
As you suggested, we created a dedicated virtual host in the server.xml
file. However, even after adding the virtual host configuration, the issue
still persists.
For example, when we access the application using:
https://sdcoradb5.hdfc.com:8083/ORDS
and replace sdcoradb5.hdfc.com:8083 with bing.com, the request is still
being redirected instead of being rejected.
Could you please confirm whether our server.xml configuration is correct,
or if there are any additional settings or configurations that need to be
added to ensure only the intended host is accepted?
Any guidance would be greatly appreciated.
Thank you, Anushka Sur
In the screenshot..we have taken other instance for testing
Screenshot for your reference:--
On Thu, 16 Jul, 2026, 11:40 Anushka sur, <an...@gmail.com> wrote:
> Sorry for the confusion..We are using tomcat version 9.0.110
>
> On Thu, 16 Jul, 2026, 11:26 Anushka sur, <an...@gmail.com> wrote:
>
>> Hi everyone,
>>
>> Thanks for the feedback. You are right — Tomcat 9.0.110 is very old, and
>> we will treat the upgrade as the first remediation step.
>>
>> We will check the issue on a newer supported Tomcat release and verify
>> whether the redirect problem is still reproducible there. If it is fixed by
>> the upgrade, we will proceed with the newer version
>>
>> if not, as suggested by mark thomas we will create virtual host.
>>
>> Thanks for pointing this out.
>>
>> Best regards,
>> Anushka Sur
>>
>> On Thu, 16 Jul, 2026, 01:33 Christopher Schultz, <
>> chris@christopherschultz.net> wrote:
>>
>>> Mark,
>>>
>>> On 7/15/26 9:56 AM, Mark Thomas wrote:
>>> > 15 Jul 2026 11:10:41 Anushka sur <an...@gmail.com>:
>>> >
>>> >> We have identified a VAPT issue in our Oracle APEX application
>>> >> deployed on
>>> >> ORDS 24.1.11 running on Apache Tomcat 9.0.11.
>>> >
>>> > That is horribly out of date. You might want to check the list of
>>> > published CVEs for 9.0.x
>>>
>>> +1
>>>
>>> The real VAPT issue should be "holy @#$%&* your Tomcat version is *how*
>>> old?"
>>>
>>> -chris
>>>
>>>
>>> ---------------------------------------------------------------------
>>> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
>>> For additional commands, e-mail: users-help@tomcat.apache.org
>>>
>>>
Re: Tomcat host header redirect issue
Posted by Anushka sur <an...@gmail.com>.
Sorry for the confusion..We are using tomcat version 9.0.110
On Thu, 16 Jul, 2026, 11:26 Anushka sur, <an...@gmail.com> wrote:
> Hi everyone,
>
> Thanks for the feedback. You are right — Tomcat 9.0.110 is very old, and
> we will treat the upgrade as the first remediation step.
>
> We will check the issue on a newer supported Tomcat release and verify
> whether the redirect problem is still reproducible there. If it is fixed by
> the upgrade, we will proceed with the newer version
>
> if not, as suggested by mark thomas we will create virtual host.
>
> Thanks for pointing this out.
>
> Best regards,
> Anushka Sur
>
> On Thu, 16 Jul, 2026, 01:33 Christopher Schultz, <
> chris@christopherschultz.net> wrote:
>
>> Mark,
>>
>> On 7/15/26 9:56 AM, Mark Thomas wrote:
>> > 15 Jul 2026 11:10:41 Anushka sur <an...@gmail.com>:
>> >
>> >> We have identified a VAPT issue in our Oracle APEX application
>> >> deployed on
>> >> ORDS 24.1.11 running on Apache Tomcat 9.0.11.
>> >
>> > That is horribly out of date. You might want to check the list of
>> > published CVEs for 9.0.x
>>
>> +1
>>
>> The real VAPT issue should be "holy @#$%&* your Tomcat version is *how*
>> old?"
>>
>> -chris
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
>> For additional commands, e-mail: users-help@tomcat.apache.org
>>
>>
Re: Tomcat host header redirect issue
Posted by Anushka sur <an...@gmail.com>.
Hi everyone,
Thanks for the feedback. You are right — Tomcat 9.0.110 is very old, and we
will treat the upgrade as the first remediation step.
We will check the issue on a newer supported Tomcat release and verify
whether the redirect problem is still reproducible there. If it is fixed by
the upgrade, we will proceed with the newer version
if not, as suggested by mark thomas we will create virtual host.
Thanks for pointing this out.
Best regards,
Anushka Sur
On Thu, 16 Jul, 2026, 01:33 Christopher Schultz, <
chris@christopherschultz.net> wrote:
> Mark,
>
> On 7/15/26 9:56 AM, Mark Thomas wrote:
> > 15 Jul 2026 11:10:41 Anushka sur <an...@gmail.com>:
> >
> >> We have identified a VAPT issue in our Oracle APEX application
> >> deployed on
> >> ORDS 24.1.11 running on Apache Tomcat 9.0.11.
> >
> > That is horribly out of date. You might want to check the list of
> > published CVEs for 9.0.x
>
> +1
>
> The real VAPT issue should be "holy @#$%&* your Tomcat version is *how*
> old?"
>
> -chris
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
Re: Tomcat host header redirect issue
Posted by Christopher Schultz <ch...@christopherschultz.net>.
Mark,
On 7/15/26 9:56 AM, Mark Thomas wrote:
> 15 Jul 2026 11:10:41 Anushka sur <an...@gmail.com>:
>
>> We have identified a VAPT issue in our Oracle APEX application
>> deployed on
>> ORDS 24.1.11 running on Apache Tomcat 9.0.11.
>
> That is horribly out of date. You might want to check the list of
> published CVEs for 9.0.x
+1
The real VAPT issue should be "holy @#$%&* your Tomcat version is *how*
old?"
-chris
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Tomcat host header redirect issue
Posted by Mark Thomas <ma...@apache.org>.
15 Jul 2026 11:10:41 Anushka sur <an...@gmail.com>:
> We have identified a VAPT issue in our Oracle APEX application deployed
> on
> ORDS 24.1.11 running on Apache Tomcat 9.0.11.
That is horribly out of date. You might want to check the list of
published CVEs for 9.0.x
> Observed behavior:
> When the application URL host is replaced with another value, the
> application redirects using that modified host instead of keeping the
> redirect restricted to the approved domain. For example, if the
> original
> host is replaced, the response follows the changed host value.
>
> For example, when the application is accessed using sdcoradb5.com:8083,
> and
> the host value is replaced with bing.com, the application redirects
> using
> the modified host value instead of the approved application domain.
>
> This indicates that the request host may be getting trusted in the
> Tomcat
> layer, which can lead to a host header injection or unvalidated
> redirect
> issue.
>
> Oracle support has advised that this needs to be checked at the Tomcat
> layer, so we are requesting your help to review the configuration and
> identify the root cause.
>
> Expected behavior:
>
> The application should only redirect to the approved application domain
> and
> should ignore or reject unexpected host values.
>
>
> Please investigate and suggest the required configuration or
> remediation
> steps.
I'm unconvinced this is an issue. All it allows is a user to construct
(and they'll have to go to some effort to do so) a request that redirects
a host of the user's choosing. I'm not seeing a security issue since the
user could just send their request directly to that other host.
This isn't something a malicious user can trick a victim into unless the
victim is running software with other vulnerabilities that expose them to
this attack.
If you really want to block this, update your virtual host configuration.
Set up one virtual host for the correct host name(s) and deploy your
application to that host.
Set up the default host with a ROOT that returns a 4xx response to all
requests.
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Tomcat host header redirect issue
Posted by Olaf Kock <to...@olafkock.de>.
Am 15.07.26 um 11:10 schrieb Anushka sur:
> We have identified a VAPT issue in our Oracle APEX application deployed on
> ORDS 24.1.11 running on Apache Tomcat 9.0.11.
> ...
> Please investigate and suggest the required configuration or remediation
> steps.
Anushka,
Have you already checked if this is still reproducible on a Tomcat
version that was published after 2018, e.g. the latest one, published
about a week ago? (Also, have you checked which other - potentially even
more dramatic security-related issues - might have been fixed in the
past 8 years since 9.0.11 was released?)
Those would be steps 1 (and likely 2, for upgrading) of the recommended
remediation steps.
Best,
Olaf
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org