Information Disclosure via X-dtHealthCheck Header

Description

The 'X-dtHealthCheck' header is commonly associated with Dynatrace or similar APM tools, used to verify the health of monitored applications or services. If disclosed externally, it may provide attackers with insights into your monitoring setup, potentially revealing endpoints or checks that can be abused. Malicious actors might spoof or manipulate these health-check requests to evade detection, trigger false positives, or disrupt the normal monitoring processes. Ultimately, leaking APM-specific health check headers can weaken observability and aid attackers in executing more stealthy or disruptive campaigns.

Remediation

Remove or obscure the 'X-dtHealthCheck' header in production environments to prevent unauthorized parties from learning about your application health checks. Configure your Dynatrace or APM settings, along with any reverse proxies or load balancers, to drop or rewrite proprietary headers. Keep your APM solution and monitored services up to date with security patches and best practices. Employ a Web Application Firewall (WAF) or intrusion detection system to watch for suspicious traffic patterns targeting health-check endpoints. Regularly audit your monitoring configurations to ensure that internal health checks and telemetry are not exposed to untrusted networks.

References

Severity

Owasp

Code: A05:2021

Category: Security Misconfiguration

Classification