Improper Neutralization Of HTTP Headers

Spring HATEOS is vulnerable to Improper Neutralization Of HTTP Headers. The vulnerability is due to not sanitizing or stripping the “Forwarded”, “X-Forwarded-Host”, “X-Forwarded-Port” or “X-Forwarded-Proto” headers. This can allow an attacker to spoof these headers values thereby bypassing security mechanisms meant to prevent illegitimate access. The application needs to use reactive web stack (Spring WebFlux) for this vulnerability to materialise.