How to Hide ActiveMQ Version in STOMP CONNECTED Header

classic Classic list List threaded Threaded
1 message Options
Reply | Threaded
Open this post in threaded view

How to Hide ActiveMQ Version in STOMP CONNECTED Header

I want to fulfill  OWASP ASVS 14.3.3
requirement, which stands:

14.3.3 Verify that the HTTP headers or any part of the HTTP response do not
expose detailed version information of system components.

For ActiveMQ broker. I have a problem with STOMP protocol CONNECTED message
which looks like this:

user-name:[hidden email]
And reveal(to hypothetical evil one) my ActiveMQ broker version So my
question is how to hide the whole server header or if it is not possible
maybe its version part.

After some research, I have found that this can be done by little hacking

1. As header server is set by constant BROKER_VERSION in code  here
2. And the value of constant BROKER_VERSION is read  here
from classpath location /org/apache/activemq/version.txt
3. We have to override the content of /org/apache/activemq/version.txt which
surprisingly reside in activemq-client

This solution works but it is inconvenient for hiding this version in a
docker container or helm package,
maybe there is another solution or maybe should I create an enhancement
request for ActiveMQ to allow configure it somehow?

I asked about this also on  stackoverflow

Sent from: