Warning regarding variable-derived host in ICAP server URL

Products

• CA API Gateway

Issue/Introduction

for some time now, we have been receiving the following warnings:

WARNING 414 com.l7tech.external.assertions.icapantivirusscanner.server.ServerIcapAntivirusScannerAssertion: ICAP server URL 'icap://${backend_host[0]}/response' contains a variable-derived host (resolved: '10.xx.xx.8') — ensure this host is intended to prevent SSRF

WARNING 659 com.l7tech.external.assertions.icapantivirusscanner.server.ServerIcapAntivirusScannerAssertion: ICAP server URL 'icap://${backend_host[0]}/request' contains a variable-derived host (resolved: '10.xx.xx.8') — ensure this host is intended to prevent SSR

These warnings are coming from our Encapsulated Assertion, which establishes the connection to our ICAP server:

The backend_host variable is defined in our Cluster-Wide Properties.

Could you please explain why we are receiving these warnings and how we can resolve or suppress them?

Environment

11.2.1

Cause

This warning message is due some added security checks in the Icap assertion which has been implemented from 11.2.1  . so this is not related to the routing assertion or using variables in general.

The icap assertions has a new check to make sure the resolved icap host is matching the host name in the server url in the icap assertion .

If this is not the case the connection to icap is denied and the assertion fails to prevent SSRF . if this hostname in the url is a variable this check does not work and the new warning message is logged .

Resolution

There are two workarounds on this 

 

1. To prevent this message from being logged is not to use variables in the icap server list . 

 

2, . you can set the cwp log.levels and add com.l7tech.external.assertions.icapantivirusscanner.server.ServerIcapAntivirusScannerAssertion.level = SEVERE

This will only log Severe level  log entries for the IcapAntivirusScannerAssertion.