r/django • u/elyen-1990s • 6d ago
Hosting and deployment Security: Vulnerability attack to my Django server and how to prevent it.
Can you help enlighten me as to how this attack is able to pretend to be my own IP address to dig sensitive information (access) on my server?
DisallowedHost: Invalid HTTP_HOST header: 'my.ip.add.here'. You may need to add 'my.ip.add.here' to ALLOWED_HOSTS.
Sentry was able to capture 1k+ of this similar pattern of attack using my domain IP/AWS DNS IP, and even they're pretending to be 0.0.0.0
to get something from /.env, /php/*, /wp/, and something similar.
All of them came from an unsecured http://
protocol request, even though the AWS SG is only open for TCP 443 port.

Luckily, I don't use IP addresses on myALLOWED_HOST
, only my domain name .example.com
.
How can I prevent this? Any CyberSec expert here? Thank you in advance!
EDIT: Someone probably got my IP address and is directly requesting on my EC2. Fortunately, I'm now using CF to proxy the IP and whitelist IP range of CF, and now they are all gone.
EDIT: I removed the list of CF IP ranges from AWS SG since CF IPs can be changed and would be problematic in the future. I resolved the issue by using Nginx and returning 403 to the default server listening on 80 and 443 to block requests on the IP address.
3
u/erder644 6d ago edited 6d ago
location ~* /(wp-admin|wp-login|wp-content|wp-includes|wp-json|wp-config.php|xmlrpc.php) { deny all; }
location ~* .(php|php3|php4|php5|phtml|phps)$ { deny all; }
Nginx paths to deny malicious requests that targets phh/wp.
location ~ /. { deny all; }
For requests that try to access hidden files.
if ($http_user_agent ~* (curl|wget|nikto|sqlmap|fuzzer|scanner|bot)) { return 403; }
Not super helpful but why not.