Web Server HTTP Header Internal IP Disclosure

they are refering to the easily to decode cookie BIGipServersecuritycode_pool , once decode you'll see the pool member IP address.

Easy solution is to encrypt the cookie.

Have a look into this great github page:

https://github.com/dnkolegov/bigipsecurity#persistence-cookie-information-leakage

I am using an encrypted cookie. I also tried removing the server agent name from the http profile. Nessus still detects the location IP.

if the problem is the Location header that expose an IP address you can try with a simple irule that will rewrite the Location, for example:

when HTTP_RESPONSE {

  if { [HTTP::header is_redirect]} {

    HTTP::header replace Location [string map -nocase {1.1.1.1 www.something.com} [HTTP::header value Location]]

  }

}

But you can implement something similar using an LTM policy.

Thanks for the reply. I did create the irule but Nessus is still detecting the same vulnerability. This is frustrating to say the least.

Here is my irule:

when HTTP_RESPONSE {

 if { [HTTP::header is_redirect]} {

  HTTP::header replace Location [string map -nocase {1.1.1.1 securitycode.summithealth.org} [HTTP::header value Location]]

 }

}

I then tried something similar using a policy:

http header named Content-Location contains any of x.x.x.x at response time.

Replace http header named Content-Location with value securitycode.summithealth.org at response time.

Still not resolved.

I was able to work around this by implementing the below irule but then the application breaks. Anyone have any ideas on how to remediate the vulnerability but keep the web site working?

when HTTP_RESPONSE {  

   if { [HTTP::header is_redirect]} {  

    HTTP::header replace Location \  

      [string map -nocase "https://x.x.x.x/vipssp/ https://securitycode.summithealth.org/vipssp/" [HTTP::header value Location]]  

   }  

 }