Security Bulletin: IBM StoredIQ is affected by potential Host Header Injection (CVE-2019-4166)

Securing StoredIQ Data Server against possible host header injection vulnerabilities

There are several vulnerabilities that may be exploited by host header injection attacks. These vulnerabilities can be mitigated on the StoredIQ Data Server by a simple configuration change.

1. Open a command-line terminal session to the Data Server and login as root.

2. Navigate to the /usr/lib/python6/site-packages/deepfile/ui/djangoweb directory.

3. Back up the settings.py file located in this directory.
4. Edit the settings.py file in the /usr/lib/python6/site-packages/deepfile/ui/djangoweb directory.
5. Locate the line that starts with ALLOWED HOSTS.
6. In the ALLOWED_HOSTS entry, supply the data server's IP address, and the data server's host name. For example, if the data server's IP address were 192.0.2.10 and the hostname were dataserver.example.com, the ALLOWED HOSTS line should look like this:
   ALLOWED_HOSTS = ['192.0.2.10','dataserver.example.com']
   If your data server has multiple IP addresses or multiple host names (or both), you can add them to the ALLOWED_HOSTS entry list.
7. Save the settings.py file.
8. Restart the AppServer service to pick up the new configuration by executing the following command:
   monit restart AppServer -c /etc/deepfile/monitrc

The data server should now be protected against known host header injection attacks. For more information about the ALLOWED_HOSTS entry in the settings.py file, visit this URL:
                https://docs.djangoproject.com/en/2.2/ref/settings/#allowed-hosts

Note that securing the data server in this manner means that URLs employed in browsers to access the data server user interface must use one of the IP addresses or host names listed in the ALLOWED_HOSTS entry of the settings.py file.