Get IP security bug?

Install / Update Security
1

I want to get the IP for the requested service. I can successfully get the ip by using frappe.local.request_ip .
But the ip can be changed by passing a header X-Forwarded-For: <dummy ip> .

This is the test that I did. I can add any value on that header and it will return that value. (The IP is the photo is just a dummy IP.)

41%20PM
41%20PM2486×722 63.8 KB

UPDATE:
After looking at source code I see that frappe.get_request_header('X-Forwarded-For') is used to get the ip.

Now, when I call this without X-Forwarded-For it returns my real IP.

48%20PM
48%20PM2496×730 61.8 KB

But if I pass X-Forwarded-For as a header it returns the dummy AND my real IP separated by comma where the Real IP is in the end.

39%20PM
39%20PM2490×728 64.5 KB

I think this should be fixed IF frappe.get_request_header('X-Forwarded-For') returns the real IP in the end.

2

Any update on this because I think this is a serious security bug. It can bypass IP restriction.

3

Hi Aldo

If you have not done so best direct this to Frappe to inform them for review

Thanks for sharing!

1 Like
4

Hi,

Could you try making the changes from this PR to your nginx configuration:

https://github.com/frappe/bench/pull/1024

This basically makes NGINX set the IP address instead of letting the user define the IP through the request. This should help fix your issue.

2 Likes
5

I changed nginx config on /home/frappe/frappe-bench/config/nginx.conf and it is still the same.

6

Thank You. Reported.

7

Did you reload the NGINX service after doing so? It should work fine thereafter.

8

Excellent Chinmay is on the case -

I hope you Frappe folks are well @chinmaypai, I enjoyed Rushabh’s account of your team getaway trek in the mountains :slight_smile:

1 Like
9

We’re doing well, and we hope you are too :slight_smile:

1 Like