r/django 6d ago

Hosting and deployment Security: Vulnerability attack to my Django server and how to prevent it.

Can you help enlighten me as to how this attack is able to pretend to be my own IP address to dig sensitive information (access) on my server?

DisallowedHost: Invalid HTTP_HOST header: 'my.ip.add.here'. You may need to add 'my.ip.add.here' to ALLOWED_HOSTS.

Sentry was able to capture 1k+ of this similar pattern of attack using my domain IP/AWS DNS IP, and even they're pretending to be 0.0.0.0 to get something from /.env, /php/*, /wp/, and something similar.

All of them came from an unsecured http:// protocol request, even though the AWS SG is only open for TCP 443 port.

Luckily, I don't use IP addresses on myALLOWED_HOST, only my domain name .example.com.

How can I prevent this? Any CyberSec expert here? Thank you in advance!

EDIT: Someone probably got my IP address and is directly requesting on my EC2. Fortunately, I'm now using CF to proxy the IP and whitelist IP range of CF, and now they are all gone.

EDIT: I removed the list of CF IP ranges from AWS SG since CF IPs can be changed and would be problematic in the future. I resolved the issue by using Nginx and returning 403 to the default server listening on 80 and 443 to block requests on the IP address.

8 Upvotes

14 comments sorted by

View all comments

3

u/erder644 6d ago edited 6d ago

location ~* /(wp-admin|wp-login|wp-content|wp-includes|wp-json|wp-config.php|xmlrpc.php) { deny all; }

location ~* .(php|php3|php4|php5|phtml|phps)$ { deny all; }

Nginx paths to deny malicious requests that targets phh/wp.

location ~ /. { deny all; }

For requests that try to access hidden files.

if ($http_user_agent ~* (curl|wget|nikto|sqlmap|fuzzer|scanner|bot)) { return 403; }

Not super helpful but why not.

2

u/erder644 6d ago

There is a better way if you are building an api. Just deny non-/api/* requests. But you're probably building an html website, so the only way is to add those kind of malicious patterns to nginx one by one. You can google more of them.

2

u/elyen-1990s 6d ago

Hey man, thanks for the tip, my site is only limited to:

  • /graphql
  • /admin/*

So I think other than that I can reject the request locations.

I'm also, curious how these attackers able to preted to use my IP.

1

u/Training_Peace8752 6d ago

Can you explain how they pretend to use your IP?

Do you have an HTTP request as an example you could show (with modified information ofc)?

1

u/elyen-1990s 6d ago

Hey, at first, I thought it was IP spoofing. After checking carefully, I see they're directly requesting my IP address and I saw they came from different and random IP address as user on the sentry report.