Uploaded image for project: 'Apache NiFi'
  1. Apache NiFi
  2. NIFI-7962

NiFi should not respond with HTTP 500 errors for HTTP TRACK request

    XMLWordPrintableJSON

Details

    • Improvement
    • Status: Resolved
    • Trivial
    • Resolution: Information Provided
    • 1.12.1
    • None
    • Core Framework

    Description

      The HTTP TRACK method was not specified in RFC 2068 [1] for HTTP 1.1 but is now available on some clients. NiFi currently responds to these requests with a 500 Internal Server Error page which reveals the version of the servlet API being used but does not contain any sensitive information. As NiFi is an open source project, the servlet API version would already be readily available to an attacker.

      The error page should be generic to obscure the servlet API version.

      [1] https://tools.ietf.org/html/rfc2068

      Attachments

        Activity

          People

            exceptionfactory David Handermann
            alopresto Andy LoPresto
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: