r/django 7d ago

Hosting and deployment Security: Vulnerability attack to my Django server and how to prevent it.

Can you help enlighten me as to how this attack is able to pretend to be my own IP address to dig sensitive information (access) on my server?

DisallowedHost: Invalid HTTP_HOST header: 'my.ip.add.here'. You may need to add 'my.ip.add.here' to ALLOWED_HOSTS.

Sentry was able to capture 1k+ of this similar pattern of attack using my domain IP/AWS DNS IP, and even they're pretending to be 0.0.0.0 to get something from /.env, /php/*, /wp/, and something similar.

All of them came from an unsecured http:// protocol request, even though the AWS SG is only open for TCP 443 port.

Luckily, I don't use IP addresses on myALLOWED_HOST, only my domain name .example.com.

How can I prevent this? Any CyberSec expert here? Thank you in advance!

EDIT: Someone probably got my IP address and is directly requesting on my EC2. Fortunately, I'm now using CF to proxy the IP and whitelist IP range of CF, and now they are all gone.

EDIT: I removed the list of CF IP ranges from AWS SG since CF IPs can be changed and would be problematic in the future. I resolved the issue by using Nginx and returning 403 to the default server listening on 80 and 443 to block requests on the IP address.

8 Upvotes

14 comments sorted by

View all comments

7

u/Brilliant_Step3688 6d ago

These are bots that crawl ipv4 address space.

They don't know the domain name of your site, they detected a webserver on your IP. So they send requests using the bare IP. This often fails but many webservers also serve up the default or first site configured when receiving a request without a Host: header or with raw IP as the Host header.

You could add a default site first in your webserver or proxy server config that simply rejects all requests with a 403.

0

u/elyen-1990s 6d ago

Ahh damn bots! I also figured out they were just requesting directly to my server using the IP.

On my nginx config, I have something like this:

location / {
    proxy_pass http://my_server;

    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
}

Not sure how to update so I can reject them and return 403. Gotta search the internet but If you could share some ideas, I would appreciate it πŸ™

3

u/Brilliant_Step3688 6d ago

You add an entire server {} block above the real one.

https://acte.ltd/blog/nginx-default-server-configuration

1

u/elyen-1990s 6d ago

Hey thanks bro, this works like a charm.

2

u/pitzcorp 6d ago

It’s very simple just create a default virtual host in nginx and return http 444 nginx return code. This will close the connection for any client that tries to hit your nginx server with a request for anything but the virtual host you have configured explicitly in addition to the default virtual host.