4

I have a microcontroller, connected to my WLAN, that hosts a tiny web server. I can reach the http server via 2 ways :

  • either via a domain (admin.example.com) which acts as a reverse proxy to the ip of the microcontroller.
  • or via the software enabled access point (192.168.0.49) spawned by the microcontroller.

If I reach the server via its domain, i print a login form to the user.

If I reach the server via its local ip in my local network, I want to skip this authentication process (if the user managed to connect to the SoftAP, or is part of the local wlan, I assume he's trusted). Thus I intend to rely on the http "Host" header, like so : If "Host" equals "192.168.0.49" then consider we are authenticated and skip the username/password form.

Is this a safe approach? Can I trust the "Host" header in this context and with such a use case, or can some evil-doer get around this and gain access?

Improve this question
6
  • Does "software enabled access point spawned by the µc" mean it is connected to the home WLAN, or is that a separate WLAN?
    – Bergi
    Commented Jan 14, 2022 at 6:44
  • Why don't you just move the authentication over to the proxy and leave the µC completely open? That sounds like both easier to set up and possibly more secure.
    – TooTea
    Commented Jan 14, 2022 at 12:01
  • @TooTea Because I want the credentials to be editable by the end-user. I store them sha1 hashed in the EEPROM.
    – Musa
    Commented Jan 14, 2022 at 13:50
  • 1
    @Bergi Soft AP is when the µc acts as a hotspot. It broadcasts its own SSID you can connect to. Once connected to it you can browse the webserver it hosts (10.10.13.37). On top of that, the µc also acts as a station, that means it can connect to your home WLAN. To sum up : admin.example.com hits a dedicated server at a 3rd party datacenter, which proxies the request to your home wlan router, which routes the request to the µc. The AP is for my fallback procedure in case there is an outage (internet down, router down, server down, etc)
    – Musa
    Commented Jan 14, 2022 at 13:59
  • 1
    @Musa Thanks for the clarification. I wanted to remark that there are three ways to reach the http server then: via the reverse proxy, via direct connection in your home WLAN, and via direct connection in the hotspot WLAN.
    – Bergi
    Commented Jan 14, 2022 at 14:14

1 Answer 1

Reset to default
21

No, it's not safe.

One can connect to admin.example.com, port 80, and send this request:

GET / HTTP/1.1
Host: 192.168.0.49
Connection: Close

And it will bypass the authentication.

The Host header is not used for that. It's intended for clients to ask for the host they want to connect when the server hosts more than one server on the same address. And it's all controlled by the client, so the client can pass whatever Host header he wants, even none.

What you can do is to check the IP of the client. If the IP is on your LAN and the IP is not the router, it's coming from the internal network.

The address of the router should not be trusted is because of NAT. Depending on your setup, and a myriad of factors, UPnP can open a port on your router to the internet, and the IP reaching your microcontroller would be the router, not the external client.

Even if you are using a reverse proxy in front of your microcontroller, is possible to an attacker to abuse UPnP and create a direct connection to your network.

Improve this answer
10
  • 7
    It does not change anything. If you close the connection, the attacker starts another with the appropriate Host header and bypasses the authentication again.
    – ThoriumBR
    Commented Jan 13, 2022 at 18:33
  • 2
    curl -v --header 'Host: 192.168.0.49' admin.example.com
    – user1067003
    Commented Jan 14, 2022 at 3:36
  • 1
    @Musa "connect to admin.example.com, port 80" is misleading. It actually means "lookup the ip of admin.example.com (in the dns or elsewhere), then connect to that ip address on port 80". The TCP connection has no knowledge of the domain name.
    – Bergi
    Commented Jan 14, 2022 at 6:47
  • 2
    @Barmar I've worked with so many types of NAT gateways that I've seem everything...
    – ThoriumBR
    Commented Jan 14, 2022 at 15:40
  • 1
    At least on Linux iptables if you neglect to set appropriate scopes on a SNAT or MASQURADE rules it's easy to end up performing source NAT on every connection that passes through the NAT box, including port forwards.
    – Peter Green
    Commented Jan 15, 2022 at 4:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .