<div dir="ltr">Yeah!<br><div><br>Thank you guys it is really connected with Value policy.<br><br></div><div>Best regards, Oleksandr<br></div></div><div class="gmail_extra"><br><div class="gmail_quote">2017-09-26 17:23 GMT+03:00 Oleksandr Nekriach <span dir="ltr"><<a href="mailto:o.nekriach@dynatech.lv" target="_blank">o.nekriach@dynatech.lv</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div>Hello Gustav,<br><br></div>I will test it<br></div>Thank you<br></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">2017-09-26 17:09 GMT+03:00 Pálos Gustáv <span dir="ltr"><<a href="mailto:gustav.palos@evolveum.com" target="_blank">gustav.palos@evolveum.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hi Oleksandr,<div><br></div><div>Please check your value policy configured for nonce and if is, remove special characters from here.</div><div><br></div><div>Best regards,</div><div><br></div><div>Gustav<br><div class="gmail_extra"><br><div class="gmail_quote"><div><div class="m_-1885058840621833122h5">2017-09-26 16:01 GMT+02:00 Oleksandr Nekriach <span dir="ltr"><<a href="mailto:o.nekriach@dynatech.lv" target="_blank">o.nekriach@dynatech.lv</a>></span>:<br></div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="m_-1885058840621833122h5"><div dir="ltr"><div><div><div><div>Hello,<br><br></div>I have found that password reset confirmation link contains invalid characters (for exp. |}{<> ) and could be exploited according to CVE-2016-6816.<br></div>Such link does not work on tomcat server if the server has not a properly configured option tomcat.util.http.parser.HttpPa<wbr>rser.requestTargetAllow=<br><br></div>Is there some workaround to bypass this issue?<br><br></div>Example of invalid link<br><a href="http://192.168.2.184:8080/midpoint/confirm/reset?user=Oleksandr.Nekriach&token=FpX3%7Be5#.z%_" rel="noreferrer" target="_blank">http://192.168.2.184:8080/midp<wbr>oint/confirm/reset?user=Oleksa<wbr>ndr.Nekriach&token=FpX3{e5#.z%<wbr>_</a><div><div><br>Logs from catalina.out<br>26-Sep-2017 16:41:00.370 INFO [http-nio-8080-exec-4] org.apache.coyote.http11.Http1<wbr>1Processor.service Error parsing HTTP request header<br> Note: further occurrences of HTTP header parsing errors will be logged at DEBUG level.<br> java.lang.IllegalArgumentExce<wbr>ption: Invalid character found in the request target. The valid characters are defined in RFC 7230 and RFC 3986<br> at org.apache.coyote.http11.Http1<wbr>1InputBuffer.parseRequestLine(<wbr>Http11InputBuffer.java:472)<br> at org.apache.coyote.http11.Http1<wbr>1Processor.service(Http11Proce<wbr>ssor.java:683)<br> at org.apache.coyote.AbstractProc<wbr>essorLight.process(AbstractPro<wbr>cessorLight.java:66)<br> at org.apache.coyote.AbstractProt<wbr>ocol$ConnectionHandler.process<wbr>(AbstractProtocol.java:868)<br> at <a href="http://org.apache.tomcat.util.net" target="_blank">org.apache.tomcat.util.net</a>.Nio<wbr>Endpoint$SocketProcessor.doRun<wbr>(NioEndpoint.java:1455)<br> at <a href="http://org.apache.tomcat.util.net" target="_blank">org.apache.tomcat.util.net</a>.Soc<wbr>ketProcessorBase.run(SocketPro<wbr>cessorBase.java:49)<br> at java.util.concurrent.ThreadPoo<wbr>lExecutor.runWorker(ThreadPool<wbr>Executor.java:1149)<br> at java.util.concurrent.ThreadPoo<wbr>lExecutor$Worker.run(ThreadPoo<wbr>lExecutor.java:624)<br> at org.apache.tomcat.util.threads<wbr>.TaskThread$WrappingRunnable.r<wbr>un(TaskThread.java:61)<br> at java.lang.Thread.run(Thread.ja<wbr>va:748)<br><br><br clear="all"><div><div><div><div><div><div class="m_-1885058840621833122m_8253089878719244966m_-6274709319895231031gmail_signature"><div dir="ltr"><div><div dir="ltr"><span style="color:rgb(76,76,76)">Best regards, <br><br>Oleksandr Nekriach | Identity and access management engineer <br><br>Dynatech, Mednieku str. 4a, Riga, LV-1010, Latvia <br><br><div style="display:inline-block"><a href="tel:+371%2025%20314%20685" value="+37125314685" target="_blank">+37125314685</a></div>, <div style="display:inline-block"><a href="mailto:o.nekriach@dynatech.lv" target="_blank">o.nekriach@dynatech.lv</a></div> | <div style="display:inline-block"><a href="http://www.dynatech.lv" target="_blank">www.dynatech.lv</a></div> <br><br><img src="cid:o.nekriach@dynatech.lv1502777022855-7770"> <br><br>Stay connected: <br><div style="display:inline-block;margin:5px 5px 0px 0px"><a href="https://www.facebook.com/DynatechLatvia/?ref=br_rs" target="_blank"><img src="cid:o.nekriach@dynatech.lv1502777022855-7771"></a></div><div style="display:inline-block;margin:5px 0px 0px"><a href="https://www.linkedin.com/company-beta/17893047/" target="_blank"><img src="cid:o.nekriach@dynatech.lv1502777022855-7772"></a></div><br><br><span style="font-size:11px;color:rgb(161,161,161)">Confidentiality
Notice: This message contains confidential information and is intended
only for the named recipient(s). If you are not the addressee you may
not copy, distribute or perform any other activities with this
information. If you have received this transmission in error, please
notify us by e-mail immediately. E-mail transmission cannot be
guaranteed to be secure or error-free as information could be
intercepted, corrupted, lost, destroyed, arrive late or incomplete, or
contain viruses.</span></span></div></div></div></div>
</div></div></div></div></div></div></div></div>
<br></div></div><span>______________________________<wbr>_________________<br>
midPoint mailing list<br>
<a href="mailto:midPoint@lists.evolveum.com" target="_blank">midPoint@lists.evolveum.com</a><br>
<a href="http://lists.evolveum.com/mailman/listinfo/midpoint" rel="noreferrer" target="_blank">http://lists.evolveum.com/mail<wbr>man/listinfo/midpoint</a><br>
<br></span></blockquote></div><span class="m_-1885058840621833122HOEnZb"><font color="#888888"><br><br clear="all"><div><br></div>-- <br><div class="m_-1885058840621833122m_8253089878719244966gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div>Gustáv Pálos</div><div>Identity Engineer</div><a href="http://evolveum.com/" rel="noreferrer" style="color:rgb(17,85,204);font-size:12.8px" target="_blank">evolveum.com</a><br></div></div>
</font></span></div></div></div>
<br>______________________________<wbr>_________________<br>
midPoint mailing list<br>
<a href="mailto:midPoint@lists.evolveum.com" target="_blank">midPoint@lists.evolveum.com</a><br>
<a href="http://lists.evolveum.com/mailman/listinfo/midpoint" rel="noreferrer" target="_blank">http://lists.evolveum.com/mail<wbr>man/listinfo/midpoint</a><br>
<br></blockquote></div><br><br clear="all"><br>-- <br><div class="m_-1885058840621833122gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><span style="color:#4c4c4c">Best regards, <br><br>Oleksandr Nekriach | Identity and access management engineer <br><br>Dynatech, Mednieku str. 4a, Riga, LV-1010, Latvia <br><br><div style="display:inline-block"><a href="tel:+371%2025%20314%20685" value="+37125314685" target="_blank">+37125314685</a></div>, <div style="display:inline-block"><a href="mailto:o.nekriach@dynatech.lv" target="_blank">o.nekriach@dynatech.lv</a></div> | <div style="display:inline-block"><a href="http://www.dynatech.lv" target="_blank">www.dynatech.lv</a></div> <br><br><img src="cid:o.nekriach@dynatech.lv1502777022855-7770"> <br><br>Stay connected: <br><div style="display:inline-block;margin:5px 5px 0 0"><a href="https://www.facebook.com/DynatechLatvia/?ref=br_rs" target="_blank"><img src="cid:o.nekriach@dynatech.lv1502777022855-7771"></a></div><div style="display:inline-block;margin:5px 0 0 0"><a href="https://www.linkedin.com/company-beta/17893047/" target="_blank"><img src="cid:o.nekriach@dynatech.lv1502777022855-7772"></a></div><br><br><span style="font-size:11px;color:#a1a1a1">Confidentiality
Notice: This message contains confidential information and is intended
only for the named recipient(s). If you are not the addressee you may
not copy, distribute or perform any other activities with this
information. If you have received this transmission in error, please
notify us by e-mail immediately. E-mail transmission cannot be
guaranteed to be secure or error-free as information could be
intercepted, corrupted, lost, destroyed, arrive late or incomplete, or
contain viruses.</span></span></div></div></div></div>
</div>
</div></div></blockquote></div><br><br clear="all"><br>-- <br><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><span style="color:#4c4c4c">Best regards, <br><br>Oleksandr Nekriach | Identity and access management engineer <br><br>Dynatech, Mednieku str. 4a, Riga, LV-1010, Latvia <br><br><div style="display:inline-block"><a href="tel:+371%2025%20314%20685" value="+37125314685" target="_blank">+37125314685</a></div>, <div style="display:inline-block"><a href="mailto:o.nekriach@dynatech.lv" target="_blank">o.nekriach@dynatech.lv</a></div> | <div style="display:inline-block"><a href="http://www.dynatech.lv" target="_blank">www.dynatech.lv</a></div> <br><br><img src="cid:o.nekriach@dynatech.lv1502777022855-7770"> <br><br>Stay connected: <br><div style="display:inline-block;margin:5px 5px 0 0"><a href="https://www.facebook.com/DynatechLatvia/?ref=br_rs" target="_blank"><img src="cid:o.nekriach@dynatech.lv1502777022855-7771"></a></div><div style="display:inline-block;margin:5px 0 0 0"><a href="https://www.linkedin.com/company-beta/17893047/" target="_blank"><img src="cid:o.nekriach@dynatech.lv1502777022855-7772"></a></div><br><br><span style="font-size:11px;color:#a1a1a1">Confidentiality
Notice: This message contains confidential information and is intended
only for the named recipient(s). If you are not the addressee you may
not copy, distribute or perform any other activities with this
information. If you have received this transmission in error, please
notify us by e-mail immediately. E-mail transmission cannot be
guaranteed to be secure or error-free as information could be
intercepted, corrupted, lost, destroyed, arrive late or incomplete, or
contain viruses.</span></span></div></div></div></div>
</div>