Re: Tomcat host header redirect issue

--000000000000a5c5e606571c4c53
Content-Type: multipart/alternative; boundary="000000000000a5c5e506571c4c52"

--000000000000a5c5e506571c4c52
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi Mark,

As you suggested, we created a dedicated virtual host in the server.xml
file. However, even after adding the virtual host configuration, the issue
still persists.

For example, when we access the application using:

https://sdcoradb5.hdfc.com:8083/ORDS

and replace sdcoradb5.hdfc.com:8083 with bing.com, the request is still
being redirected instead of being rejected.

Could you please confirm whether our server.xml configuration is correct,
or if there are any additional settings or configurations that need to be
added to ensure only the intended host is accepted?

Any guidance would be greatly appreciated.

Thank you, Anushka Sur

In the screenshot..we have taken other instance for testing
 Screenshot for your reference:--




On Thu, 16 Jul, 2026, 11:40 Anushka sur, <[email protected]> wrote:

> Sorry for the confusion..We are using tomcat version 9.0.110
>
> On Thu, 16 Jul, 2026, 11:26 Anushka sur, <[email protected]> wrote:
>
>> Hi everyone,
>>
>> Thanks for the feedback. You are right =E2=80=94 Tomcat 9.0.110 is very =
old, and
>> we will treat the upgrade as the first remediation step.
>>
>> We will check the issue on a newer supported Tomcat release and verify
>> whether the redirect problem is still reproducible there. If it is fixed=
 by
>> the upgrade, we will proceed with the newer version
>>
>> if not, as suggested by mark thomas we will create virtual host.
>>
>> Thanks for pointing this out.
>>
>> Best regards,
>> Anushka Sur
>>
>> On Thu, 16 Jul, 2026, 01:33 Christopher Schultz, <
>> [email protected]> wrote:
>>
>>> Mark,
>>>
>>> On 7/15/26 9:56 AM, Mark Thomas wrote:
>>> > 15 Jul 2026 11:10:41 Anushka sur <[email protected]>:
>>> >
>>> >> We have identified a VAPT issue in our Oracle APEX application
>>> >> deployed on
>>> >> ORDS 24.1.11 running on Apache Tomcat 9.0.11.
>>> >
>>> > That is horribly out of date. You might want to check the list of
>>> > published CVEs for 9.0.x
>>>
>>> +1
>>>
>>> The real VAPT issue should be "holy @#$%&* your Tomcat version is *how*
>>> old?"
>>>
>>> -chris
>>>
>>>
>>> ---------------------------------------------------------------------
>>> To unsubscribe, e-mail: [email protected]
>>> For additional commands, e-mail: [email protected]
>>>
>>>

--000000000000a5c5e506571c4c52
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"auto"><p>Hi Mark,</p>
<p>As you suggested, we created a dedicated virtual host in the <code>serve=
r.xml</code> file. However, even after adding the virtual host configuratio=
n, the issue still persists.</p>
<p>For example, when we access the application using:</p>
<p><code><a href=3D"https://sdcoradb5.hdfc.com:8083/ORDS" target=3D"_blank"=
 rel=3D"noreferrer">https://sdcoradb5.hdfc.com:8083/ORDS</a></code></p>
<p>and replace <code><a href=3D"http://sdcoradb5.hdfc.com:8083" target=3D"_=
blank" rel=3D"noreferrer">sdcoradb5.hdfc.com:8083</a></code> with <code><a =
href=3D"http://bing.com" target=3D"_blank" rel=3D"noreferrer">bing.com</a><=
/code>, the request is still being redirected instead of being rejected.</p=
>
<p>Could you please confirm whether our <code>server.xml</code> configurati=
on is correct, or if there are any additional settings or configurations th=
at need to be added to ensure only the intended host is accepted?</p>
<p>Any guidance would be greatly appreciated.</p>
<p>Thank you,
Anushka Sur</p><p>In the screenshot..we have taken other instance for testi=
ng=C2=A0</p><div dir=3D"auto"><div dir=3D"auto"></div><div dir=3D"auto">=C2=
=A0Screenshot for your reference:--</div><div dir=3D"auto"><br></div><img s=
rc=3D"cid:ii_19f842b46bf6be592ba1" style=3D"max-width: 100%; height: auto;"=
><br><div dir=3D"auto"><br></div></div></div><br><div class=3D"gmail_quote"=
><div dir=3D"ltr" class=3D"gmail_attr">On Thu, 16 Jul, 2026, 11:40 Anushka =
sur, &lt;<a href=3D"mailto:[email protected]" target=3D"_blank" rel=3D"nor=
eferrer">[email protected]</a>&gt; wrote:<br></div><blockquote class=3D"gm=
ail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-le=
ft:1ex"><div dir=3D"auto">Sorry for the confusion..We are using tomcat vers=
ion 9.0.110</div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"g=
mail_attr">On Thu, 16 Jul, 2026, 11:26 Anushka sur, &lt;<a href=3D"mailto:a=
[email protected]" rel=3D"noreferrer noreferrer" target=3D"_blank">anusur35=
@gmail.com</a>&gt; wrote:<br></div><blockquote class=3D"gmail_quote" style=
=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir=
=3D"auto">Hi everyone,=C2=A0<div dir=3D"auto"><br><div dir=3D"auto">Thanks =
for the feedback. You are right =E2=80=94 Tomcat 9.0.110 is very old, and w=
e will treat the upgrade as the first remediation step.</div><div dir=3D"au=
to"><br></div><div dir=3D"auto">We will check the issue on a newer supporte=
d Tomcat release and verify whether the redirect problem is still reproduci=
ble there. If it is fixed by the upgrade, we will proceed with the newer ve=
rsion</div><div dir=3D"auto"><br></div><div dir=3D"auto">if not, as suggest=
ed by mark thomas we will create virtual host.</div><div dir=3D"auto"><br><=
/div><div dir=3D"auto">Thanks for pointing this out.</div><div dir=3D"auto"=
><br></div><div dir=3D"auto">Best regards,</div><div dir=3D"auto">Anushka S=
ur</div></div></div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=
=3D"gmail_attr">On Thu, 16 Jul, 2026, 01:33 Christopher Schultz, &lt;<a hre=
f=3D"mailto:[email protected]" rel=3D"noreferrer noreferrer nore=
ferrer" target=3D"_blank">[email protected]</a>&gt; wrote:<br></=
div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-lef=
t:1px #ccc solid;padding-left:1ex">Mark,<br>
<br>
On 7/15/26 9:56 AM, Mark Thomas wrote:<br>
&gt; 15 Jul 2026 11:10:41 Anushka sur &lt;<a href=3D"mailto:anusur35@gmail.=
com" rel=3D"noreferrer noreferrer noreferrer noreferrer" target=3D"_blank">=
[email protected]</a>&gt;:<br>
&gt; <br>
&gt;&gt; We have identified a VAPT issue in our Oracle APEX application <br=
>
&gt;&gt; deployed on<br>
&gt;&gt; ORDS 24.1.11 running on Apache Tomcat 9.0.11.<br>
&gt; <br>
&gt; That is horribly out of date. You might want to check the list of <br>
&gt; published CVEs for 9.0.x<br>
<br>
+1<br>
<br>
The real VAPT issue should be &quot;holy @#$%&amp;* your Tomcat version is =
*how* <br>
old?&quot;<br>
<br>
-chris<br>
<br>
<br>
---------------------------------------------------------------------<br>
To unsubscribe, e-mail: <a href=3D"mailto:[email protected]=
rg" rel=3D"noreferrer noreferrer noreferrer noreferrer" target=3D"_blank">u=
[email protected]</a><br>
For additional commands, e-mail: <a href=3D"mailto:[email protected]=
.org" rel=3D"noreferrer noreferrer noreferrer noreferrer" target=3D"_blank"=
>[email protected]</a><br>
<br>
</blockquote></div>
</blockquote></div>
</blockquote></div>

--000000000000a5c5e506571c4c52--
--000000000000a5c5e606571c4c53--