How to safely invoke Webhooks
blog.fanout.io
How to safely invoke Webhooks
1–10 of 18 posts
Re: How to safely invoke Webhooks
#2Another option: route traffic through an external (authenticated) proxy.
Re: How to safely invoke Webhooks
#3What if I send you to http://lvh.me:10000/some/resource/?method=DELETE/ ?
edit: ok, it doesn't pass the socket.gethostbyname check
Re: How to safely invoke Webhooks
#4Another option: route traffic through an external (authenticated) proxy.
Yeah, this is point 3 under the mitigation section. The only gotcha with this one is that you want to be sure there aren't any vulnerable local services on the proxy server itself. But this should be manageable.
It also may be possible to bind the connect port on the proxy and then use an iptables rule to prevent any connections from that source port from connecting to localhost.
Re: How to safely invoke Webhooks
#5What if I send you to http://lvh.me:10000/some/resource/?method=DELETE/ ? edit: ok, it doesn't pass the socket.gethostbyname check
Indeed. You, know, though... I was almost afraid to click this from my personal machine.
Fortunately, links in a browser will always perform a GET, which hopefully is unlikely to do anything terrible on your own computer.
Re: How to safely invoke Webhooks
#6What if I send you to http://lvh.me:10000/some/resource/?method=DELETE/ ? edit: ok, it doesn't pass the socket.gethostbyname check
Indeed. You, know, though... I was almost afraid to click this from my personal machine. Fortunately, links in a browser will always perform a GET, which hopefully is unlikely to do anything terrible on your own computer.
Links in a browser will always perform a GET, unless there's some JS attached to the click handler :) Fortunately I think HN is pretty safe.
Re: How to safely invoke Webhooks
#7Interesting. Never implemented a service which uses Webhooks, but this is something I had never thought about. Useful to keep in mind.
Re: How to safely invoke Webhooks
#8Another option: route traffic through an external (authenticated) proxy.
Yeah, this is point 3 under the mitigation section. The only gotcha with this one is that you want to be sure there aren't any vulnerable local services on the proxy server itself. But this should be manageable. It also may be possible to bind the connect port on the proxy and then use an iptables rule to prevent any connections from that source port from connecting to localhost.
The local port for outgoing TCP connections is chosen randomly in the normal case - and you can't have two TCP connections between the same pair of ports and hosts, so it would be hard to write a good proxy server that let you pick the local outgoing port.
You could use ipt_owner with iptables to block by source user matching the proxy server, however. Or just configure your proxy to block by outgoing IP if it supports this.
Re: How to safely invoke Webhooks
#9I'm not a Pythonista, but AIUI the example code will still follow redirects, so internal pokes can still be made.
Re: How to safely invoke Webhooks
#10Earlier quoted context omitted.
Yeah, this is point 3 under the mitigation section. The only gotcha with this one is that you want to be sure there aren't any vulnerable local services on the proxy server itself. But this should be manageable. It also may be possible to bind the connect port on the proxy and then use an iptables rule to prevent any connections from that source port from connecting to localhost.
The local port for outgoing TCP connections is chosen randomly in the normal case - and you can't have two TCP connections between the same pair of ports and hosts, so it would be hard to write a good proxy server that let you pick the local outgoing port. You could use ipt_owner with iptables to block by source user matching the proxy server, however. Or just configure your proxy to block by outgoing IP if it suppor…
I think the poster meant IP not port.
Most proxy servers can be configured bind to a specific IP. So if your proxy server has an external IP and an internal IP, configure the proxy server to bind to the external IP. And then use IPTables to block any connections from the external IP to the internal network.