Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Internal IP Exposure #12278

Open
brenak opened this issue Nov 15, 2017 · 2 comments
Open

Internal IP Exposure #12278

brenak opened this issue Nov 15, 2017 · 2 comments
Labels
c: Security For issues that make Matomo more secure. Please report issues through HackerOne and not in Github.
Milestone
For Prioritization

Comments

@brenak
Copy link

brenak commented Nov 15, 2017

This is in the latest version of Piwik 3.2.0

If you head to the HTTPS address, using the direct IP, and get the warning message about an untrusted hostname, then view the source of that page, the listing for piwik.piwik_url is the INTERNAL IP and not the EXTERNAL that you used to get there. This should be fixed, it’s a low risk, but the internal should never be exposed to the general public. The only work around we have right now is to disable this feature using enable_trusted_host_check=0 Viewing the source with it disabled, displays the correct external IP.
@sgiehl
Copy link
Member

sgiehl commented Nov 15, 2017

Haven't had a closer look, but afaik it should output $_SERVER['HTTP_HOST']

@sgiehl sgiehl added the c: Security For issues that make Matomo more secure. Please report issues through HackerOne and not in Github. label Nov 15, 2017
@mattab
Copy link
Member

mattab commented May 9, 2019

Report today:

Matomo discloses the server's internal IP address via the 'Location' header if you access /index.php/ with a non-default host header

For example:
curl -v -H 'Host: demo.matomo.org:123' https://demo.matomo.org/index.php/
...
< HTTP/1.1 302 Found
< Location: https://127.0.235.163/index.php

Internal IP disclosure poses no real risk on its own, but it makes exploiting other vulnerabilities like SSRF quite a lot easier. I do not expect a bounty for this.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
c: Security For issues that make Matomo more secure. Please report issues through HackerOne and not in Github.
Projects
None yet
Milestone
For Prioritization
Development

No branches or pull requests
4 participants
@mattab @sgiehl @brenak @innocraft-automation