http://coldfusion.com logo
Join Slack
Powered by
I had a recent client bug bounty where the attacke...
# lucee
j
I had a recent client bug bounty where the attacker spoofed the X-Forwarded-For header with 127.0.0.1 and was able to view the Lucee debugging info ( queries, paths, etc… ) on a website ( IIS ). Lucee is running on CommandBox in production mode. Can anything be done to prevent this? It would be nice to allow debugging from an IP/MAC address combo ( at least for localhost ). That seems more secure. I realize MAC addresses are not accessible in headers or CGI vars, but if localhost requests and responses could be validated by CommandBox or Lucee, it would seem possible. Something like the TomCat secret but for requests and not the connector. ( I just disabled all debugging to resolve the issue and will only use my remote ip as needed ).
b
@jakobward The latest version of CommandBOx disables use of the proxy peer address header by default
What version of CommandBox are you on?
you'll want 5.5.2
You can re-enable it only if your server is behind a proxy which always sets a trusted forwarded for header
j
Cool! This server does need an update, I will recommend it.
b
There is no other workaround for this however.
If you trust the proxy in front of you, then you can use the header reliably, of you don't trust the proxy in front of you, then you can't trust the header!
That said, even though CommandBox won't use that header by default to change the 
cgi
scope, it will still be there if you want to use it for logging, etc
j
Dig it. I have an Apache server which is behind a CloudFlare proxy and I HAD to use the X-Forwarded-For header to get the original remote IP. I guess I have some further investigating to do.
b
So in theory, both cloudflare's proxy and Apache's proxy can be setting that HTTP header
👍🏻 1
The question is whether either (or both of them) will always set their own header, removing any previously set headers from upstream
What I've generally seen is a proxy will set their own header so even if malicious user with postman sets a fake forwarded-for header, the proxy will ignore it
but as always, you'll have to check through the docs for those proxies and test to see how they handle
It should be easy to re-create the fake header with a postman request
j
Yes, I saw that in use. Will do. Thanks!
5 Views
Open in Slack
PreviousNext
Powered by