- Security - example.com

[djehuty-security] Re: Unchecked reverse proxies?
by Roel Janssen 03 Nov '25

03 Nov '25

Dear Ben, Thank you a lot for your message! Sorry for the delay. As I wrote the X-Forwarded-For bits for djehuty, I will read into it further. You are right that it only affects the logging. However, the significance is not to be dismissed if we can do better. As it is deployed (I believe), nginx strips X-Forwarded-For headers and adds its own. But I am actually not sure. However, as you point out, we could/should implement a configuration option to only allow the X- Forwarded-For header from a certain IP address, which should make it more secure against confusing or wrong configurations. By the way, as I am uncertain whether I am welcome/allowed to contribute to djehuty, I silently forked it here: https://codeberg.org/roelj/djehuty My intentions are to upstream my changes, but I found no reasonable way to actually do so. (I even switched jobs over it). I will know more about this unfortunate situation at the end of November and am hopeful for a good outcome. If you would like to be involved in creating a patch for implementing the allowed IP address range to pass a X-Forwarded-For header, I'd love to help/give it a try on this fork. Thank you again for your report and insights. I hope the djehuty codebase will be useful to you. If you'd like to collaborate, I am very happy to and certain we can find ways to do so (even applying for funding if you wish). Kind regards, Roel Janssen On Tue, 2025-10-14 at 19:53 +0000, Companjen, B.A. (Ben) wrote: > > > > Hi, > > I came across Djehuty recently and skimmed the code and > documentation, when I noticed that while there is a way to configure > the use of "X-Forwarded-For" header to get the client IP address, > there is no configuration option for limiting the IP address(es) that > are allowed to set this header. I believe allowing any source to set > the header would allow spoofing the client IP. I haven't tried to > confirm this behaviour or test if this makes e.g. 4TU.ResearchData > vulnerable; I do know that I had to set an IP address (range) for > Nextcloud and other applications to accept requests from. > > Reading > https://owasp.org/www-community/pages/attacks/ip_spoofing_via_http_headers > , and understanding from the code that the header value is only used > in logging, perhaps the risk is not very high. > > I am not an expert on this specific topic, so perhaps it could > suffice to make the reverse proxy itself strict (it should remove > existing X-Forwarded-For headers before setting it) and configure the > network to only allow web traffic from the reverse proxy. However, > the documentation does not warn about the consequences of not taking > precautions within or around the software when using a reverse proxy. > It looks like the example configuration in the documentation using > nginx would overwrite any existing X-Forwarded-For header, which is > probably good. > > I hope you will consider risks associated with not preventing IP > spoofing in the application. > > Regards, > > Ben Companjen > > > > > > Ben Companjen > Research Software and Data Engineer / Digital Scholarship Librarian > Centre for Digital Scholarship > Leiden University Libraries (UBL) > > Tel: +31634556900 > Post: Postbus 9501, 2300 RA Leiden > E-mail:b.a.companjen@library.leidenuniv.nl > Web:https://www.universiteitleiden.nl/en/staffmembers/ben-companjen > > _______________________________________________ > Security mailing list -- security(a)djehuty.4tu.nl > To unsubscribe send an email to security-leave(a)djehuty.4tu.nl

2 1

[djehuty-security] Unchecked reverse proxies?
by Companjen, B.A. (Ben) 14 Oct '25

14 Oct '25

Hi, I came across Djehuty recently and skimmed the code and documentation, when I noticed that while there is a way to configure the use of "X-Forwarded-For" header to get the client IP address, there is no configuration option for limiting the IP address(es) that are allowed to set this header. I believe allowing any source to set the header would allow spoofing the client IP. I haven't tried to confirm this behaviour or test if this makes e.g. 4TU.ResearchData vulnerable; I do know that I had to set an IP address (range) for Nextcloud and other applications to accept requests from. Reading https://owasp.org/www-community/pages/attacks/ip_spoofing_via_http_headers , and understanding from the code that the header value is only used in logging, perhaps the risk is not very high. I am not an expert on this specific topic, so perhaps it could suffice to make the reverse proxy itself strict (it should remove existing X-Forwarded-For headers before setting it) and configure the network to only allow web traffic from the reverse proxy. However, the documentation does not warn about the consequences of not taking precautions within or around the software when using a reverse proxy. It looks like the example configuration in the documentation using nginx would overwrite any existing X-Forwarded-For header, which is probably good. I hope you will consider risks associated with not preventing IP spoofing in the application. Regards, Ben Companjen Ben Companjen Research Software and Data Engineer / Digital Scholarship Librarian Centre for Digital Scholarship Leiden University Libraries (UBL) Tel: +31634556900 Post: Postbus 9501, 2300 RA Leiden E-mail: b.a.companjen(a)library.leidenuniv.nl<mailto:b.a.companjen@library.leidenuniv.nl> Web: https://www.universiteitleiden.nl/en/staffmembers/ben-companjen

1 0

[djehuty-security] REQUEST FOR QUOTATION
by PTY 30 Jun '25

30 Jun '25

Good Day, Invitation to Bid for possible supply and delivery of the below product. UNILEVER N.V requests you or your company to participate in sending us an official quotation on the requested TENDER. Product Unique Code: INDST9368-LLC7X50M Pump Product : INDST9368-LLC7X50M Pump Item: Qty. 55 Units If your supplier has the items to the quantity required then kindly send us your quotation for immediate approval. E-mail: *info(a)unileversupplychain.net <info(a)unileversupplychain.net>* CM Procurement Mgr London - Unilever 100 Victoria Embankment, London EC4Y 0DY,United Kingdom Regards Reginaldo Ecclissato Chief Global Supply Officer Tel: +447491598955 Fax: +447452298417

1 0

[djehuty-security] Test
by Roel Janssen 27 May '25

27 May '25

Test Kind regards, Roel Janssen Senior Software Engineer at 4TU.ResearchData.

1 0

[djehuty-security] Re: Vulnerability Report: HTML Injection Vulnerability
by Roel Janssen 26 May '25

26 May '25

Dear Anass, Thank you for reporting the HTML injection vulnerability on https://data.4tu.nl<https://data.4tu.nl/>. I can confirm to have reproduced it. Due to the Content-Security-Policy, it doesn't render the CSS, so what's left is just the anchor tag. I attached a patch to resolve the problem, for which I'd like to invite you to be the (co-)author of. This patch has been applied to our testing environment, so you can test it out further: https://next.data.4tu.nl/search?institutions=28589&datatypes=%22%3E%3Ca%20s… If you would like to be (co-)author, then please let me know whether the "From" line (name and e-mail address) is correct. Thank you again for your efforts and reporting! Kind regards, Roel Janssen ________________________________ From: Info Security <infosec0011a(a)gmail.com<mailto:infosec0011a@gmail.com>> Date: Thu, 22 May 2025 at 22:26 Subject: Vulnerability Report: HTML Injection Vulnerability To: <researchdata(a)4tu.nl<mailto:researchdata@4tu.nl>> Hello, My name is Anass, and I am a security researcher.I have discovered an HTML injection vulnerability on the following page: Vulnerable URL: https://data.4tu.nl/search?institutions=28589&datatypes=%22%3E%3Ca%20style=… This injection allows an attacker to insert arbitrary HTML elements into the page, which could be used for phishing or to trick users into clicking malicious links. Impact: An attacker could display fake messages or UI elements, potentially leading to user deception or redirection to malicious websites. Please let me know if you need further details or a proof-of-concept demo. Best regards, Anass K. Security Researcher

1 0

[djehuty-security] Funny Short Video - The Most Popular Videos
by FUNNY SHORT VIDEO 19 May '25

19 May '25

1 0

[djehuty-security] Google's
by Abiya Yadav 16 May '25

16 May '25

Hello, Good Morning I hope this email finds you well. We can place your website on Google AOL, Yahoo, and Bing’s 1st page. May I send you a quote? If interested? Regards, Abhya

1 0

[djehuty-security] Google’s 1st page.?
by Jayanti lal 22 Apr '25

22 Apr '25

Hi, Good morning I hope this email finds you well! I found your detail on Google.com and I have looked at your website and realize your website is great design but your website ranking not good all search engine Google, AOL, Yahoo, and Bing. We can place your website on Google’s 1st page. May I send you a quote? If interested. Best regards, Jayatnti

1 0

[djehuty-security] (no subject)
by Bảo Trần 20 Apr '25

20 Apr '25

1 0

Test
by Roel Janssen 16 Jan '25

16 Jan '25

test

1 0

2026

2025

Security ----- 2026 ----- March 2026 February 2026 January 2026 ----- 2025 ----- December 2025 November 2025 October 2025 September 2025 August 2025 July 2025 June 2025 May 2025 April 2025 March 2025 February 2025 January 2025

Security