Need

Prevention of internal IP address exposure

Context

• Usage of Go 1.16 for developing high-performance and efficient applications
• Usage of gin-gonic/gin for building web applications and APIs in Go
• Usage of net/http for creating HTTP servers in a Node.js application

Description

Non compliant code

        package main

import (
	"github.com/gin-gonic/gin"
	"net/http"
)

func main() {
	r := gin.Default()
	r.GET("/", func(c *gin.Context) {
		c.String(http.StatusOK, "Server IP: 192.168.1.1") // Exposing internal IP
	})
	r.Run() // listen and serve on 0.0.0.0:8080
}
        
        

In the above Go code, we are using the Gin web framework to create a simple HTTP server that listens on port 8080. The server has one route, "/", and when this route is hit with a GET request, the server responds with a string that contains the server's internal IP address (in this case, "192.168.1.1").

This is a clear example of a technical information leak vulnerability, specifically leaking the internal IP address. The internal IP address is sensitive information that should not be exposed to the public. By doing so, we are providing potential attackers with valuable information that they could use to carry out more targeted attacks against the server.

In the context of an internal IP address, knowing this could allow an attacker to bypass certain security measures or target specific services running on this internal IP. This could lead to more serious attacks such as Denial of Service (DoS), unauthorized data access, or even remote code execution in some cases.

Therefore, it's crucial to ensure that such technical information is not leaked through the web server's responses.

Steps

• Avoid exposing internal IP addresses in the web server response.
• Use a reverse proxy or load balancer to handle incoming requests and hide the internal IP address of the server.
• Configure the reverse proxy or load balancer to forward requests to the backend server without exposing the internal IP.
• Ensure that the web server only returns necessary information to the client and does not leak sensitive data like internal IP addresses.
• Regularly update and patch the server software and dependencies to prevent any potential vulnerabilities that could expose internal IP addresses.

Compliant code

        package main

import (
	"github.com/gin-gonic/gin"
	"net/http"
)

func main() {
	r := gin.Default()
	r.GET("/", func(c *gin.Context) {
		c.String(http.StatusOK, "Hello, World!") // Removed the internal IP
	})
	r.Run() // listen and serve on 0.0.0.0:8080
}
        
        

The original code was exposing the internal IP address of the server in the response of the root endpoint ("/"). This is a security vulnerability as it leaks technical information that could be used by an attacker to exploit the system.

The fixed code removes the exposure of the internal IP address. Instead of returning the IP address in the response, it now returns a simple "Hello, World!" message. This way, no internal technical information is leaked to the client.

In addition to this code fix, it's recommended to use a reverse proxy or load balancer to handle incoming requests. This hides the internal IP address of the server and adds an additional layer of security. The reverse proxy or load balancer should be configured to forward requests to the backend server without exposing the internal IP.

Also, ensure that the web server only returns necessary information to the client and does not leak sensitive data like internal IP addresses. Regularly update and patch the server software and dependencies to prevent any potential vulnerabilities that could expose internal IP addresses.

References

• 290. Technical information leak - IPs