4

I have a microcontroller, connected to my WLAN, that hosts a tiny web server. I can reach the http server via 2 ways :

  • either via a domain (admin.example.com) which acts as a reverse proxy to the ip of the microcontroller.
  • or via the software enabled access point (192.168.0.49) spawned by the microcontroller.

If I reach the server via its domain, i print a login form to the user.

If I reach the server via its local ip in my local network, I want to skip this authentication process (if the user managed to connect to the SoftAP, or is part of the local wlan, I assume he's trusted). Thus I intend to rely on the http "Host" header, like so : If "Host" equals "192.168.0.49" then consider we are authenticated and skip the username/password form.

Is this a safe approach? Can I trust the "Host" header in this context and with such a use case, or can some evil-doer get around this and gain access?

6
  • Does "software enabled access point spawned by the µc" mean it is connected to the home WLAN, or is that a separate WLAN?
    – Bergi
    Jan 14 at 6:44
  • Why don't you just move the authentication over to the proxy and leave the µC completely open? That sounds like both easier to set up and possibly more secure.
    – TooTea
    Jan 14 at 12:01
  • @TooTea Because I want the credentials to be editable by the end-user. I store them sha1 hashed in the EEPROM.
    – Musa
    Jan 14 at 13:50
  • 1
    @Bergi Soft AP is when the µc acts as a hotspot. It broadcasts its own SSID you can connect to. Once connected to it you can browse the webserver it hosts (10.10.13.37). On top of that, the µc also acts as a station, that means it can connect to your home WLAN. To sum up : admin.example.com hits a dedicated server at a 3rd party datacenter, which proxies the request to your home wlan router, which routes the request to the µc. The AP is for my fallback procedure in case there is an outage (internet down, router down, server down, etc)
    – Musa
    Jan 14 at 13:59
  • 1
    @Musa Thanks for the clarification. I wanted to remark that there are three ways to reach the http server then: via the reverse proxy, via direct connection in your home WLAN, and via direct connection in the hotspot WLAN.
    – Bergi
    Jan 14 at 14:14
20

No, it's not safe.

One can connect to admin.example.com, port 80, and send this request:

GET / HTTP/1.1
Host: 192.168.0.49
Connection: Close

And it will bypass the authentication.

The Host header is not used for that. It's intended for clients to ask for the host they want to connect when the server hosts more than one server on the same address. And it's all controlled by the client, so the client can pass whatever Host header he wants, even none.

What you can do is to check the IP of the client. If the IP is on your LAN and the IP is not the router, it's coming from the internal network.

The address of the router should not be trusted is because of NAT. Depending on your setup, and a myriad of factors, UPnP can open a port on your router to the internet, and the IP reaching your microcontroller would be the router, not the external client.

Even if you are using a reverse proxy in front of your microcontroller, is possible to an attacker to abuse UPnP and create a direct connection to your network.

10
  • Would this bypass work if I force a connection close after I have served each http request? As far as I understand, this bypass relies on the fact that the attackers maintains the successfully open tcp connection at admin.example.com in order to fake the Host header afterwards?
    – Musa
    Jan 13 at 18:10
  • 6
    It does not change anything. If you close the connection, the attacker starts another with the appropriate Host header and bypasses the authentication again.
    – ThoriumBR
    Jan 13 at 18:33
  • 1
    curl -v --header 'Host: 192.168.0.49' admin.example.com Jan 14 at 3:36
  • @Musa "connect to admin.example.com, port 80" is misleading. It actually means "lookup the ip of admin.example.com (in the dns or elsewhere), then connect to that ip address on port 80". The TCP connection has no knowledge of the domain name.
    – Bergi
    Jan 14 at 6:47
  • 2
    @Barmar I've worked with so many types of NAT gateways that I've seem everything...
    – ThoriumBR
    Jan 14 at 15:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.